Deleted

Deleted I found the origin of the offending string with the ampersand in German Windows, it's C:\Windows\System32\de-DE\msobjs.dll.mui.

If I disable the localization by taking ownership of the file, adding access rights, renaming it and rebooting, the error message in Policy Analyzer is gone.

You can also see the offending string by running auditpol /backup /file:backup.csv.

Of course it's still a bug in Policy Analyzer that it doesn't properly sanitize/escape the messages.