Forum Discussion

david0K's avatar
david0K
Copper Contributor
May 17, 2024

ASRs via Intune not working (only on Windows 11 Clients)

We have been using some ASR rules in our company for a longer period of time. We have set these up via Intune. Since we have been using Windows 11, we have had some problems with a few ASR rules. o...
Intune
david0K's avatar
david0K
Copper Contributor

Hi Jordi_Koenderink, the problem is that even when I hunt for the ASRs in MS Defender, it shows that the setting Block all Office applications from creating child processes is off(there are 2 more settings). But according to our settings, this should not be the case. It also works on the Windows 10 devices, as set.

Jordi_Koenderink's avatar
Jordi_Koenderink
Brass Contributor
May 22, 2024
Not sure what you're saying here. The ASR is showing as Off in the Advanced Hunting tab but you set it to On regardless? If so, what does your query look like?
  • david0K's avatar
    david0K
    Copper Contributor
    May 24, 2024

    Yes, the notebooks are all in the same configuration group and all get the same settings.
    On the Windows 10 devices, the three settings are set to Audit. On the Windows 11 devices, they are displayed as off.
    See as an example a Win10 device and a Win11 device. The remaining settings are all the same.
    See also the query in the screenshot.

     

    an other query:

     

     

    • Jordi_Koenderink's avatar
      Jordi_Koenderink
      Brass Contributor
      May 25, 2024

      Are you sure the devices have had enough time to receive the ASR policy? Also, please show me a screen of the ASR.

      • david0K's avatar
        david0K
        Copper Contributor
        Jun 05, 2024

        Hi Jordi_Koenderink, sorry for the late reply. 

        We've had the szenario for over 2 months now. That means there has definitely been enough time.

        We have set the ASR to All Devices via the Defender Baseline:

         

         

         Scoped to All Devices:

         

Resources