ASR Rule issue

Copper Contributor

Hi,

 

We have enabled ASR rules using SCCM but 'block credential stealing from the windows local security authority subsystem (lsass.exe)' shows as not applicable. Any ideas why?

 

PLivingston11_0-1694978138331.png

 

 

Thanks

Phil

 

2 Replies
What version of Windows are you using, not all versions of windows OS are compatible
Hi Bill,

We are using 22h2, fully patched.