Windows Defender Exploit Guard should be enabled on machines - False Positive

Question

I configured my VM running Win11 Enterprise as follows, but am still getting flagged for this.

Note: I installed the Guest Configuration extension on this same server (see last screen shot).

Thanks

Answer 1

I was able to resolve this by enabling Controlled Folder via the Group Policy Management Editor interface. I originally used the PowerShell Command per https://learn.microsoft.com/en-us/defender-endpoint/enable-controlled-folders?WT.mc_id=Portal-Microsoft_Azure_Security:

Set-MpPreference -EnableControlledFolderAccess Enabled

This did not work per the documentation, so I had to set this manually as follows:

Answer 2

I'm still getting "Windows Defender Exploit Guard should be enabled on machines" despite:

1. enabling Controlled Folder
2. Guest Configuration extension has been provisioned successfully
3. ASR rules

Please advise.