u/Commercial_Big2898

We’re seeing an issue with Windows 11 25H2, Horizon non-persistent VDI, App Volumes 2512 and Microsoft Defender.

When we test if MS Defender is working correcly we see this:

EICAR (testfile) on the local OS disk MS Defender does not detect it.
EICAR on a network share MS Defender detects it immediately.

Procmon shows MsMpEng.exe trying to access the local EICAR file but receiving ACCESS DENIED.
Defender exclusions are already configured according to Omnissa recommendations.

I hoped this would work out of the box. Did some troubleshooting already, but no luck yet. Has anyone a solution or same issue?