Windows 10: Microsoft confirms "Local Security protection is off" Microsoft Defender issue

Microsoft Windows 11 systems may display the error message "Local Security protection is off. Your device may be vulnerable." after installation of a recent Microsoft Defender Antivirus update.

Microsoft confirmed the issue for Windows 11 and Windows 11 version 22H2 on its Release Health website. Both versions of the Windows 11 operating system are affected in the same way by the issue. The known issues listings for supported Windows 10 versions does not have the entry, which suggests that these operating systems are not affected by it.

Windows 11 devices may throw the error message after installation of KB5007651 on Windows 11 devices. The update's full name is Update for Microsoft Defender Antivirus antimalware platform - KB5007651, and it should be listed as one of the installed updates by update management services.



Windows administrators who enable Local Security Authority protection on Windows 11 devices may resolve the issue, but it leads directly to a follow-up issue. Once enabled, Windows 11 may "persistently prompt that a restart is required" through its notifications system.

Microsoft recommends that administrators ignore the restart prompts, provided that they have enabled Local Security Authority protection and restarted the Windows 11 device at least once.

A support page reveals how system administrators may use the System log under Windows Logs in the Event Viewer to determine whether Local Security Authority protection (LSASS.exe) is enabled.

The log should have this entry: "12: LSASS.exe was started as a protected process with level: 4".

Enabling Local Security Authority Protection on Windows 11


Local Security Authority protection "helps protect user credentials by preventing unsigned drivers and plugins from loading into the Local Security Authority". A support page on Microsoft's Learn websites has additional information.

When enabled, Local Security Authority protection prevents code injections that "could compromise credentials". Plugins and drivers need to have a valid signature and adhere to the Microsoft Security Deployment Lifecycle process guidance. If they don't, they won't be loaded.

Windows administrators may enable the security feature in the following way:

1. Open the Start Menu and load the Settings application.
2. Select the Privacy & security tab.
3. Activate the Windows Security option on the page that opens.
4. Select Device Security on the next page; this opens the Windows Security app.
5. On the Device Security page, select "Core isolation details".
6. Toggle Local Security Authority protection to ON under Core isolation.

Microsoft notes that it does not recommend any other workarounds for the issues. While it does not mention any, it may refer to the uninstallation of the Microsoft Defender Antivirus update on the affected Windows 11 device.

The company is working on a full resolution of the issue and plans to "provide an update as soon as it is available".

Thank you for being a Ghacks reader. The post Microsoft confirms "Local Security protection is off" Microsoft Defender issue appeared first on gHacks Technology News.

read more...

 

Introducing Microsoft Defender: New Microsoft 365 online security app

Read more:

• https://www.microsoft.com/en-us/micr...d-your-family/
• https://www.microsoft.com/security/b...r-individuals/

 

Clear Windows Security Center (Defender) Protection History

Did not work for me. After going through all steps I still have protection history full

 

Microsoft Security Bulletin for September 2007

Microsoft released yesterday the September Security Bulletin for Windows operating system, as part of its monthly security cycle. This bulletin summary lists one critical and three important updates. For more information, see Microsoft Security Bulletin Summary for September 2007.

Source: Microsoft