Defender says that Block Adobe Reader from creating child processes is not active

Question

I created a configuration for ASR in Intune, which should set Block Adobe Reader from creating child processes to block. In the screenshot you can see that the value is set to block but in the Defender Portal the client shows the policy as still open. Is there anything else that needs to be adjusted during the configuration? The Defender recognized the rest of the settings correctly, except for this point.

Answer 1

@Wolf Dominik Thanks for posting in our Q&A.

For this issue, please try the following actions:

1.Please check the "Connection status" and "Last synchronized" time under Tenant administration > Connectors and tokens > Microsoft Defender for Endpoint in Intune portal. It will display if the connection is normal between Intune and Defender.

2.In our official article. it shows that once the connection is established, the services are expected to sync with each other at least once every 24 hours. Please wait and check if it will sync.

https://learn.microsoft.com/en-us/mem/intune/protect/advanced-threat-protection-configure

Hope it will help.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.