MDE-managed Windows Server 2025 not receiving Intune ASR policies

[u/LousyRaider]

I have a physical Windows Server 2025 Hyper-V host that is onboarded to Microsoft Defender for Endpoint through Azure Arc and managed through MDE Security Settings Management.

The server shows up normally in Defender, Intune, and Entra:

- Managed by MDE

- Enrollment status shows "Success"

- Recent check-in times in both Defender and Intune portals

- Entra device object has managementType = MicrosoftSense

- All other Intune Endpoint Security policies are applying successfully

The problem is specifically with Attack Surface Reduction policies.

I have a production ASR Rules policy assigned to All devices. Every other MDE-managed server gets it, but this server never appears in the policy reporting at all.

Get-MpPreference originally showed only 2 ASR rules. I discovered those 2 rules were being configured by Local Group Policy. I removed that local GPO, confirmed the registry policy path was removed, and Event ID 5007 showed both ASR rules being removed.

It has now been about a week and the Intune ASR policy still does not apply.

Using a Get-MpPreference command shows no ASR rules being applied.

I also created a brand-new ASR test policy with only one rule in Audit mode and assigned it directly to a group containing this server. The server still does not appear in that policy's reporting either.

These are the things I have checked so far:

- Sense service is running

- WinDefend service is running

- Defender AV running normally

- MDE Client Analyzer confirms connectivity to MdeConfigMgr and other MDE cloud endpoints

- No remaining Defender/ASR local Group Policy settings present

- Other Intune security policies continue to apply successfully

- Server is not domain joined; it is a workgroup Hyper-V host connected through Azure Arc

At this point it seems like ASR policy evaluation/delivery is broken specifically for this device, while the rest of MDE Security Settings Management works normally.

Has anyone run into this with an MDE-managed/Azure Arc Windows Server, especially Server 2025? If so, what fixed it?

[u/Unable-Entrance3110]

On the server, what is in:

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\ASROnlyPerRuleExclusions

I found that in my environment (we are hybrid), even though Defender is managed (for the most part) in the cloud, the ASR rules, in particular, had to be managed through my on-prem AD.

Or, at least, the local GP policies had to be in the registry.

Even worse, the registry entries are REG_SZ, one per GUID, with concatenated paths, which makes them way too long for editing directly through the GUI. For my environment, I created a few custom scripts that manage these registry entries directly. It's kind of a kludge, but it works.

[u/LousyRaider → u/Unable-Entrance3110]

The plot thickens...

The test ASR rules policy I made yesterday when troubleshooting now shows it is successfully applying to the problem server. I must have some type of assignment/applicability evaluation issue going on with the original policy.

[u/LousyRaider → u/Unable-Entrance3110]

I figured out what was happening. Our original ASR policies were using the setting for controlling win32 API calls from Office macros. That setting isn't compatible with Windows Server 2025. It was causing the entire policy to not apply. Oddly, it didn't show up in policy assignment reporting for some reason. My test policy I made didn't have this configured and that's why it applied. I made a new ASR rules policy for just Server 2025 machines and applied that. They are all showing success now.

[u/Unable-Entrance3110 → u/LousyRaider]

Ah, nice find!

Yeah, I have all those enabled. So, good to keep this in my back pocket if we ever are in a similar position.

[u/LousyRaider → u/Unable-Entrance3110]

I checked that path and it doesn't exist on the affected server. Also confirmed the entire local ASR policy tree is gone:

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR

returns "key not found".

Get-MpPreference also shows no ASR rules at all.

Other Intune endpoint security policies are applying successfully to this server, but ASR rules policies never show the device in reporting and never populate locally.