How to test ASR policy AsrPsexecWmiChildProcessAudited ?

Question

Hi Team,I want to test the ASR policy in my environment. Could someone help me with test scripts or commands to test ASR "AsrPsexecWmiChildProcessAudited" policy? I surfed lot not getting exact script or commands. Thanks in advance!Warm regardsKapildev Chandrasekaran

p4tr8k · Answer

Hi,you can use:https://demo.wd.microsoft.com/Page/ASRhttps://demo.wd.microsoft.com/Page/ASR2

rahuljindal · Answer

What OS platform and SKU are you planning to use for testing? Are the devices managed by any enterprise solution?

kapildev_c · Answer

Yes devices are managed by enterprise solution. Currently I'm testing in Windows 10 21H2 Machine.

rahuljindal · Answer

What edition of Windows 10? ASR support is limited in PRO edition. Also, what tool are using to manage the devices? Intune? Configuration manager? or non Microsoft solution?

kapildev_c · Answer

Thanks for the swift response. We are using windows 10 enterprise everything is configured using Intune. We just need to see the ASR "AsrPsexecWmiChildProcessAudited" results in Microsoft 365 Defender by executing some commands, for that I need some PowerShell scripts or commands. Could you please guide me?

Forum Discussion

How to test ASR policy AsrPsexecWmiChildProcessAudited ?

10 Replies