Implementing ASR - Block credential stealing

sumo83 

Yes, this is expected. As a default, ASR policies are supposed to be conservative. There are some malicious activities that behaves in a similar way to legitimate activity. Microsoft defaults on the side of caution and alerts on these files. This is not unusual. 

I suggest that you add exceptions for necessary Windows files, so you don't encounter a situation where you block critical processes. 

The best practice here would be to review these policies on a scheduled basis. Digital environments can change and policies should be reviewed to ensure they are still relevant.