As an admin stuck with Microsoft Defender, I'm facing major headaches due to ASR rules implemented in Intune. I find that creating a simple exception can take an incredibly long time—sometimes upwards of 20 minutes. Why can't we just right-click the icon and disable it temporarily with a password? It's frustrating to have to wait for a report on what Defender is blocking, especially since I have to guess the file path based on where my colleague is testing. After making an exception, I have to sync it with the client and hope it works. Although I know troubleshooting mode is an option, it's not reliable. Are we doing something wrong? It feels like MS is complicating things for admins rather than simplifying them. Plus, adding Lenovo issues into the mix just adds to the frustration.
5 Answers
Is it really that hard to wait 15 minutes for security settings? I get the need for security, but it shouldn't take forever just to enable or bypass stuff. Actually, dealing with security in a timely manner should be a priority.
Normally, you’d start with ASR rules set to Audit mode, review the logs, and then create exclusions for legitimate processes. However, it seems ever since we rolled it out, Defender is blocking apps that have been in use for years, causing all sorts of headaches.
I totally get where you're coming from! It would be so helpful to have a quick pause or bypass setting for ASR rules like other security solutions offer. It’s frustrating to have to deal with all these delays when time is of the essence.
The delays in M365 products drive me crazy too! Intune's syncing times can be unpredictable, taking anywhere from 5 minutes to several hours. I’m the only one in my company managing it, and the constant wait times are exhausting. I heard the product team was supposedly working on fixes, but they clearly don’t see it as a priority.
When ASR rules are in Block or Audit modes, you can check the Event logs for info on what got blocked, but I’ve noticed they sometimes don’t show up in the reports right away. I initiated troubleshooting mode recently and waited, but it still didn’t help.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures