Hi Limork,
From cli you can execute the command to change from dry-run to enable.
First you need to get all the volumenes on dry-run:
security anti-ransomware volume show -state dry-run
And then enable them:
security anti-ransomware volume enable -vserver vserver_name -volume volume_name
Is recommened 30 days on dry-run of the volumes before enable them.
Kind regards,
Albert