SONAR can't detect DNS Change

Freshly installed SEPM and SEP Client on a Windows Server 2008. Fully updated and communication is healthy and functional.

Under Proactive Threat Protection > System Change Detection > DNS change detected and Host file change detected are both on Block, but when I change the DNS configuration or the Host file, it doesn't work and I can change them successfully either manually or by scripts and commands.

I'm logged in by the administrator account and tried with a different admin account and limited user, all same results.

There are no logs left.

Licensing is ok, this is a trial version and still valid. I use default Balanced and High Security policies and nothing of the default settings are changed.

Any idea?