ASR detection shows Rules Turned OFF on machines

[PraveenrajThyagarajan]

Hi Team,

We have recently migrated from TrendMicro to MSDATP ( Cloud) along with Defender as AV . We have deployed Exploit Guard policy on all WKs  through SCCM CB however when i checked Attack Surface detection rule -  shows Rule is turned off on  few machines . Any idea how to fix it and  Also please let me know which of ASR rules should be enabled in Audit mode for pilot phase .

[#2]

@PraveenrajThyagarajan did you find the cause for this issue?

[#3]

@PraveenrajThyagarajan any chance you have conflicts arising from GPO that is taking precedence?

[#4]

Hi, you might opt to run a powershell script deployment for via intune on the machines where you have the problem so you can forcefully activate it