"Warn" for Block executable files from running unless they meet a prevalence, age, or trusted list criteria doesn't work anymore

[u/Key-Anywhere5846]

for years, we have the ASR "Block executable files from running unless they meet a prevalence, age, or trusted list criteria" set to warn. This way our devs got a dialog, that the execution of their new exes is blocked, but they could click "unblock" and the exe was executed.

for about a week (started before 2026-08 update), this doesnt work anymore.

while there is still the dialog for unblocking, there is already an error in the background and even after hitting unblock, the files wont execute and show the same error again.

as soon as I allowlist the folder in the ASR, it works. So nothing else (Applocker, WDAC, AV,...) is responsible for that blockage.

get-mppreference shows, that the according rule (01443614-cd74-433a-b99e-2ecdc07bfc25) is set to warn (6)

Eventlog shows one 1121 Event: Defender Exploit Guard blocked one action by IT administrator

I am not aware of anything that was changed on our end that could indirectly affect this behavior. And as MSFTs 1st level non-support sadly wont even understand what the issue is, I try to find any information in here. Maybe even someone else noticed this issue or can reproduce

(recreation/translation of actual screenshot by ChatGPT)