Last month, security researcher Chaotic Eclipse (better known as Nightmare-Eclipse) managed to bypass Windows 11's sophisticated BitLocker security feature using a USB stick. Nightmare claimed that Microsoft "intentionally" left a backdoor in the security feature:

"Could have made some insane cash selling this, but no amount of money will stand between me and my determination against Microsoft." The company has since patched three zero-day exploits published by the security researcher, including YellowKey, GreenPlasma, and MiniPlasma.

More recently, Nightmare-Eclipse disclosed a new zero-day vulnerability dubbed RoguePlanet, which affects Microsoft Defender on both Windows 11 and Windows 10. The exploit could allow attackers to gain full control of affected systems (via Bleeping Computer).

Microsoft acknowledged the vulnerability and indicated that it's tracking the RoguePlanet zero-day exploit under CVE-2026-50656. According to the company:

"Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ". We are working to provide a high quality security update that addresses this vulnerability. We will provide information in this CVE when the update is available."

The security sleuth shared a proof-of-concept exploit in a self-hosted Git repository, further claiming that Microsoft had scrapped its repository hosting exploits on GitHub and GitLab.

Perhaps more interestingly, this news comes after Microsoft previously fronted Windows 11’s Defender as enough for most PC owners. "Microsoft Defender Antivirus covers everyday risks without requiring additional software,” the company added.

The statement seemed highly debatable in the community, though many still agreed with Microsoft's sentiments, including some of Windows Central's readers:

"It's not a secret, Windows Defender has been the best or near the best antivirus for years by now. Times when third-party antivirus actually served a purpose are long gone. You're just slowing down your system and paying for no reason."

In a subsequent blog post, Microsoft admitted that while Windows 11's Defender is usually enough for most users, third‑party tools add extra layers of protection, including identity monitoring or built-in VPNs.

Elsewhere, Nightmare-Eclipse and Microsoft had been locked in a months-long battle, with Microsoft even threatening legal action. But after backlash from the wider cybersecurity community, the company signaled it no longer intends to pursue lawsuits against researchers who conduct or publish their findings.

Join us on Reddit at r/WindowsCentral to share your insights and discuss our latest news, reviews, and more.

What you need to know

• Recently, an update Microsoft pushed to Windows Defender began causing Windows Security to display warnings that Local Security Authority protection was disabled, even if it was enabled previously.
• These warnings persisted even if users manually reenabled LSA protection and restarted their PC, causing many to worry.
• Microsoft's patch for the issue didn't work and is "no longer being offered," but thankfully, there's a workaround — ignoring the problem.
• As long as users are able to verify that LSA protection is on through the Event Viewer app, Windows Security's warnings can be dismissed. If you installed the ineffective update and are experiencing blue screens or abrupt restarts, you'll need to disable Kernel-mode Hardware-enforced Stack Protection, however.

The Microsoft Defender Antivirus software (also known as Windows Defender) is at the core of standard Windows security, but in late March, an update to it caused a concerning bug with the Windows Security app. Everyone who downloads and installs the update sees a warning that "Local Security Authority protection is off. Your device may be vulnerable," even if it was enabled previously. 

These messages continue to persist even if LSA protection is reenabled and a restart is performed, and since the LSA manages user rights information and passwords, many users are understandably worried.

The issue was soon confirmed by Microsoft, and about a month later in April, the firm released a patch for it (Version 1.0.2303.27001). However, after users reported that the bug was continuing to persist and that further issues were introduced, Microsoft recently scrapped the patch and confirmed that the update "is no longer being offered to devices" on its Windows Health page. Thankfully, though, there's a workaround for the original problem — and it's a simple one.

"If you have enabled Local Security Authority (LSA) protection and have restarted your device at least once, you can dismiss warning notifications and ignore any additional notifications prompting for a restart," writes the company. "Currently, we do not recommend any other workaround for this issue."

Essentially, you can safely dismiss or ignore any LSA protection alerts Windows 11 pushes as long as you're able to verify that LSA protection is actually active after you enable it and restart your PC. You can do this by opening the Event Viewer app, going into the Windows Logs section, and searching for this WinInit event in the System log:

• 12: LSASS.exe was started as a protected process with level: 4

Notably, Microsoft says that if you installed the ineffective update (Version 1.0.2303.27001) and experience blue screen errors or restarts when opening apps or games, you have to disable Kernel-mode Hardware-enforced Stack Protection to resolve the problem. This can be done by opening Windows Security, selecting Device Security, selecting Core Isolation, and toggling the Kernel-mode Hardware-enforced Stack Protection option off.

Ultimately, it's good to know that there's not something terribly serious going on here, though this bug will definitely continue alarming people that haven't seen Microsoft's assurances. The firm explained that it's "working on a resolution and will provide an update in an upcoming release," so hopefully the issue will be fixed soon.

Microsoft Defender Antivirus is the default anti-malware application on every Windows 11 installation, designed to protect your computer and file from a wide range of security threats, such as viruses, spyware, ransomware, and hackers. 

The antivirus runs automatically in the background, constantly scanning, detecting, and removing unwanted threats. However, users can also customize the application according to their preferences, such as performing manual scans, including offline scans to remove tricky viruses. Additionally, you can turn off real-time protection and enable extra layers of security, such as anti-ransomware protection and periodic scanning.

In this how-to guide, I will walk you through the steps to start managing settings and using the features available on Microsoft Defender Antivirus on Windows 11.

How to install update definitions on Defender Antivirus

To update the definition of the Microsoft Defender Antivirus, use these steps:

1. Open Start.
2. Search for Windows Security and click the top result to open the app.
3. Click on Virus & threat protection.
4. Under the "Virus & threat protection updates" section, click the protections updates option.

5. Click the "Check for updates" button.

Once you complete the steps, antivirus signature updates will download and install automatically to scan, detect, and remove the latest threats.

The antivirus usually downloads updates automatically, but sometimes, checking manually before proceeding with a manual scan might still be necessary.

How to scan for malware on Defender Antivirus

Windows 11 automatically scans your computer for malware using the Microsoft Defender Antivirus. However, if you suspect the device may be infected, you can use the available options to perform a scan manually.

Quick Scan

A quick scan takes the least amount of time because it only scans the locations where malware is more likely to hide.

To perform a quick scan with the Defender Antivirus, use these steps:

1. Open Start.
2. Search for Windows Security and click the top result to open the app.
3. Click on Virus & threat protection.
4. Under the "Current threats" section, click the Scan options setting.

5. Select the Quick scan option.
6. Click the Scan now button.

After you complete the steps,  under the "Current threats" section on the main page, you can review if the antivirus found any threats.

If you think the malware is still on the device, you should perform a full virus scan.

Full Scan

A full scan takes the longest because, as the name implies, it scans all the locations on the hard drive.

To perform a full scan with the Defender Antivirus, use these steps:

1. Open Start.
2. Search for Windows Security and click the top result to open the app.
3. Click on Virus & threat protection.
4. Under the "Current threats" section, click the Scan options setting.

5. Select the Full scan option.
6. Click the Scan now button.

Once you complete the steps, the anti-malware will try to detect any virus that may have infected the system. 

Custom Scan

A custom scan allows you to scan a particular section of the main drive or external storage. Usually, you would use this feature to check an external USB drive, flash drive, or a specific file you downloaded from the internet.

To perform a custom scan with the Defender Antivirus, use these steps:

1. Open Start.
2. Search for Windows Security and click the top result to open the app.
3. Click on Virus & threat protection.
4. Under the "Current threats" section, click the Scan options setting.

5. Select the Custom scan option.

6. Choose the folder or drive location.
7. Click the Select Folder button.

After you complete the steps, the location specified location will be scanned for malware. Alternatively, you can browse to the location, right-click the drive, folder, or file, click "Show more options," and choose the "Scan with Microsoft Defender" option.

How to exclude scan locations on Defender Antivirus

If you want to prevent the antivirus from scanning a particular folder or file, you can add and remove scanning locations.

To prevent the Microsoft Defender Antivirus from scanning specific locations, use these steps:

1. Open Start.
2. Search for Windows Security and click the top result to open the app.
3. Click on Virus & threat protection.
4. Under the "Virus & threat protection settings" section, click the Manage settings option.

5. Under the "Exclusion" section, click the "Add or remove exclusions" option.

6. Select the exclusion type:

• File.
• Folder.
• File type.
• Process.

7. Select the folder location.
8. Click the Select Folder button.

Once you complete the steps, the Defender Antivirus will not scan your specified location. You may need to repeat the steps to add more exclusions.

How to perform offline malware scan on Defender Antivirus

On Windows 11, you may sometimes come across complex malware that the antivirus may not be able to remove while the system is running. In this case, you can perform an offline scan. When activating this feature, the computer will restart and go into the Windows Recovery Environment (WinRE) to perform a scan while the system is offline. 

To perform an offline scan with the Defender Antivirus, use these steps:

1. Open Start.
2. Search for Windows Security and click the top result to open the app.
3. Click on Virus & threat protection.
4. Under the "Current threats" section, click the Scan options setting.

5. Select the "Microsoft Defender Antivirus (offline scan)" option.
6. Click the Scan now button.

Once you complete the steps, the offline version of the antivirus will scan the device, and it will remove or quarantine any detection automatically.

After the scan is complete, the Microsoft Defender Antivirus will save the report, which you can review through the Windows Security app, and then the computer will restart automatically.

How to view scan malware history on Defender Antivirus

Whether you recently performed a virus scan or want to view recent protection actions, the Microsoft Defender Antivirus also includes a page where you can review the protection history and recommendations.

To view the protection history of the Microsoft Defender Antivirus, use these steps:

1. Open Start.
2. Search for Windows Security and click the top result to open the app.
3. Click on Virus & threat protection.
4. Under the "Current threats" section, click the Protection history option.

5. Click the "Filters" drop-down menu and select the history you want to review, including:

• Recommendations.
• Quarantined items.
• Cleaned items.
• Blocked actions.
• Severity.

6. Select the item to view more information, including malware type, severity level, detection date, category, and information about the item's location.

After you complete the steps, the page will show you a report of the protection history.

How to allow threats on Defender Antivirus

Sometimes, the antivirus may detect an application or file as a threat when you know it comes from a trusted source. If this happens, the application includes an option to allow the threat.

To allow a threat on the Defender Antivirus, use these steps:

1. Open Start.
2. Search for Windows Security and click the top result to open the app.
3. Click on Virus & threat protection.
4. Under the "Current threats" section, click the Allow threats option.

5. Select the app or file you want to prevent the application from blocking.
6. Check the "Allow on the device" option.

Once you complete the steps, the device will allow the threat. You may also view the item under the "Current threats" section on the Microsoft Defender Antivirus page.

How to temporarily disable Defender Antivirus

If the Microsoft Defender Antivirus prevents an app installation or another action, you can temporarily turn off the antivirus to complete the task. 

To disable the Microsoft Defender Antivirus temporarily on Windows 11, use these steps:

1. Open Start.
2. Search for Windows Security and click the top result to open the app.
3. Click on Virus & threat protection.
4. Under the "Virus & threat protection settings" section, click the manage settings option.

5. Turn off the "Real-time protection" toggle switch.

After you complete the steps, the antivirus will temporarily disable its protection to install apps or make specific system changes without conflicts.

Once the computer restarts, the antivirus will be enabled again automatically. Or you can use the instructions outlined above, but in step 5, turn on the "Real-time protection" toggle switch.

If you want to disable the Microsoft Defender Antivirus permanently, you can refer to these instructions.

How to enable ransomware protection on Defender Antivirus

Microsoft Defender Antivirus is a sophisticated anti-malware solution with ransomware protection known as "Controlled folder access." When this feature is enabled, it monitors and protects your data against ransomware attacks and unwanted changes from malicious applications.

However, since this feature can cause false positives, it's something that you must enable manually.

To enable Windows 11's anti-ransomware feature, use these steps:

1. Open Start.
2. Search for Windows Security and click the top result to open the app.
3. Click on Virus & threat protection.
4. Under the "Virus & threat protection settings" section, click the Manage settings option.

5. Under the "Controlled folder access" section, click the "Manage Controlled folder access" option.

6. Turn on the "Controlled folder access" toggle switch.

7. Click the Block history option to access the "Protection history" page to view blocked folder access.
8. (Optional) Click the Protected folders option to add (or remove) additional protected folders.
9. (Optional) Click the "Allow an app through Controlled folder access" option to allow apps you trust to make changes to the protected folders.

After you complete the steps, the feature will monitor apps trying to change files in the protected folders. If the app is flagged as malicious or unknown, Controlled folder access will block the attempt, and you'll receive an activity alert.

If your computer gets compromised, you may be able to recover the files from your OneDrive account (if previously configured).

How to disable tamper protection on Defender Antivirus

Tamper Protection is a feature of the Microsoft Defender Antivirus that protects the Windows Security app from unwanted changes not made directly from the application.

Usually, you want to leave this feature enabled since it adds an extra layer of protection. However, if it's causing problems when you have to manage settings from another app, Command Prompt, or PowerShell, you can turn it off.

To turn off tamper protection on the Microsoft Defender Antivirus, use these steps:

1. Open Start.
2. Search for Windows Security and click the top result to open the app.
3. Click on Virus & threat protection.
4. Under the "Virus & threat protection settings" section, click the Manage settings option.

5. Turn off the Tamper Protection toggle switch.

Once you complete the steps, the Tamper Protection feature will be disabled, allowing you to make setting changes from another application.

If you no longer need to change settings, it's best to enable the feature again. You can do this using the same instructions, but in step 5, turn on the "Tamper Protection" toggle switch.

How to enable periodic scanning on Defender Antivirus

Microsoft Defender Antivirus also has a "periodic scanning" feature that is only available if you have a third-party antivirus installed on your computer.

If you have a third-party antivirus, you can enable this feature to periodically scan and remove threats that other security applications may have missed. 

In other words, if you have another antivirus, Microsoft Defender Antivirus can turn on periodically to perform another scan to ensure that your other antivirus hasn't missed anything.

To enable periodic scanning on Windows 11, use these steps:

1. Open Start.
2. Search for Windows Security and click the top result to open the app.
3. Click on Virus & threat protection.
4. Click the "Microsoft Defender Antivirus options" setting.
5. Turn on the Periodic scanning toggle switch.

After you complete the steps, Microsoft Defender Antivirus will remain off, allowing third-party security software to monitor your system. However, periodically, it'll turn on again to perform a secondary scan.

More resources

For more helpful articles, coverage, and answers to common questions about Windows 10 and Windows 11, visit the following resources:

• Windows 11 on Windows Central — All you need to know
• Windows 10 on Windows Central — All you need to know

What you need to know

• Microsoft Defender for Endpoint offers various security and safety features on iOS.
• Until now, enterprises have needed end-users to interact in order for Defender for Endpoint deployment to go through.
• Now, devices that are already enrolled with Microsoft Endpoint Manager can have Microsoft Defender for Endpoint deployed to them with zero action required on the part of the end-user.

Microsoft's just released a dollop of news that likely won't mean much to the average iOS user but will mean something to enterprises using Microsoft Defender for Endpoint on iOS. Now devices can be zero-touch onboarded to Defender for Endpoint, meaning end-users won't have to do a thing in order for their respective enterprise to deploy in a timely fashion. This feature is in public preview.

So long as a device is enrolled with Microsoft Endpoint Manager, the end-user won't need to interact. For those wondering what Defender for Endpoint is and why this news is a big (relatively speaking) deal, here's Microsoft's blog post's description:

You can find additional documentation at Microsoft's blog post wherein the public preview announcement was made.

As for other news in the world of Microsoft products, be sure to check for the updated Photos app if you're on Windows 11, and read up on the hardships of making a Skype account thanks to a recent influx of Captchas haunting what used to be a very simple service signup process.

Microsoft Defender Antivirus is one of the best antivirus for Windows 10, which offers real-time protection against viruses, spyware, ransomware, and many other forms of malware. Although the security feature works in the background automatically and usually notifies you of any suspicious or unwanted activities, it also provides a protection history report to help you stay informed and take action on the device security as necessary.

The protection history is part of the Windows Security app, and it shows a list of recent malware detections with information that allows you to determine if the threat has been cleaned, removed, or quarantine until an update arrives to Windows 10 to resolve the problem.

If you're using the anti-ransomware feature, the history will also show blocked actions, which you can review and allow if the default action was a false-positive.

In this Windows 10 guide, we'll walk you through the easy steps to view the malware detection history by Microsoft Defender Antivirus using the Windows Security app and PowerShell commands.

• How to view malware protection history using Windows Security
• How to view malware protection history using PowerShell

How to view malware protection history using Windows Security

To see all the malware detections on your device, use these steps:

1. Open Start.
2. Search for Windows Security and click the top result to open the app.
3. Click on Virus & threat protection.
4. Under the "Current threats" section, click the Protection history option.

5. Confirm the list of threats found by Microsoft Defender Antivirus.Quick note: If you don't see any items listed, you can breathe a little easier since it indicates that Microsoft Defender hasn't detected any malware. If you want to make entirely sure that the device isn't infected, you can always run a full scan with these steps.

6. Select the item to view more information, including malware type, severity level, detection date, category, and information about the item's location.

7. (Optional) If the list includes various items, you can also use the Filters option in the top-right corner to filter the view by:
   • Recommendations.
   • Quarantined items.
   • Cleaned items.
   • Blocked actions (Blocked folder access, Blocked items, and Rule-based block).
   • Severity (Severe, High, Moderate, and Low).

Once you complete the steps, you'll have a better understanding of your device's current security.

How to view malware protection history using PowerShell

Alternatively, you can also get a history list of the malware that Microsoft Defender Antivirus has detected with PowerShell commands.

To query a list of detected threats with PowerShell, use these steps:

1. Open Start.
2. Search for PowerShell, right-click the top result, and select the Run as administrator option.
3. Type the following command to view a history of threats and press Enter:Get-MpThreat
4. See the list of threats found on your computer with information like threat execution, active status, and infected file location.

5. (Optional) Type the following command to view a list of active and pass malware detections and press Enter:Get-MpThreatDetection
6. See the list of malware detections with information like detection date, location of the infected file, action, and more

After you complete the steps, you'll be able to determine the malware that Microsoft Defender was able to detect on Windows 10.

In the above steps, we're mentioning to commands, and if you're wondering the difference between the two. The

Get-MpThreat

command is meant to show a history of threats, while the

Get-MpThreatDetection

command can list active and past malware detections by the antivirus.

You can learn more ways to manage the antivirus on Windows 10 using PowerShell with this comprehensive guide.

On Windows 10, Microsoft Defender Antivirus comes built into the Windows Security experience, and it offers real-time protection from viruses, ransomware, spyware, and other malware and hacker attacks.

In addition to scanning local files, the security feature also allows you to enable an option to scan network files. The option used to be enabled out of the box on Windows 10, but it's no longer the case with the latest version of the antivirus.

Usually, it's not recommended to enable this feature. However, there are still some situations when you may need to use it, for instance, when the antivirus isn't able to scan certain files, or you receive a specific error that will only be resolved by enabling scan for network files.

In this Windows 10 guide, we'll walk you through the steps to enable scan network files on Microsoft Defender Antivirus.

Related: Best Antivirus Software 2020

• How to enable Microsoft Defender scan network files with Group Policy
• How to enable Microsoft Defender scan network files with PowerShell
• How to enable Microsoft Defender scan network files with Registry

How to enable Microsoft Defender scan network files with Group Policy

If you're running Windows 10 Pro (or Enterprise), the easiest way to enable scan network files is using the Local Group Policy Editor.

To scan network files with Microsoft Defender Antivirus, use these steps:

1. Open Start.
2. Search for gpedit and click the top result to open the Group Policy Editor.
3. Browse the following path:Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Scan
4. Double-click the Scan network files policy on the right side.

5. Check the Enabled option.

6. Click the Apply button.
7. Click the OK button.

Once you complete the steps, network files will be scanned during automatic and manual scans.

If you want to revert the changes, you can use the same instructions, but on step No. 5, make sure to select the Not configured option.

How to enable Microsoft Defender scan network files with PowerShell

To allow Microsoft Defender to network files with PowerShell, use these steps:

1. Open Start.
2. Search for PowerShell, right-click the top result, and click the Run as administrator option.
3. Type the following command to enable scan network files and press Enter:Set-MpPreference -DisableScanningNetworkFiles 0

4. (Optional) Type the following command to disable scan network files and press Enter:Set-MpPreference -DisableScanningNetworkFiles 1

After you complete the steps, Microsoft Defender Antivirus will be able to scan network files. You can check this guide to learn more about the different ways to manage the antivirus using PowerShell commands.

How to enable Microsoft Defender scan network files with Registry

Alternatively, it's also possible to enable network file scan option using the Registry.

To allow the Windows 10 default antivirus to scan network files modifying the Registry, use these steps:

Warning: This is a friendly reminder that editing the Registry is risky and can cause irreversible damage to your installation if you don't do it correctly. It's recommended to make a full backup of your PC before proceeding.

1. Open Start.
2. Search for regedit and click the top result to open the Registry.
3. Browse the following path:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows DefenderQuick tip: On Windows 10, you can now copy and paste the path in the Registry's address bar to quickly jump to the key destination.
4. Right-click the Windows Defender (folder) key, select New, and click on Key.

5. Name the key Scan and press Enter.
6. Right-click the newly created key, select New, and click on DWORD (32-bit) Value.

7. Name the key DisableScanningNetworkFiles and press Enter.
8. Double-click the newly created DWORD and make sure the value is 0.

9. Click the OK button.
10. Restart your computer.

Once you complete the steps, during the next scan, network files will be checked for malware.

In the case that you want to undo the changes, you can use the same instructions, but on step No. 4, make sure to right-click the Scan key and select the Delete option.

What you need to know

• Some HP computers are experiencing BSODs.
• A conflict between Windows Defender and HP software updates is thought to be the cause.
• A patch from HP is rolling out to address the problem.

HP released an update recently that appears to fix an issue that caused several severe errors on a variety of devices. HP users on a range of devices recently saw the Blue Screen of Death (BSOD) and boot loops on their machines. While reports with those types of errors appeared before the May 12 Patch Tuesday update, the issue seemed to increase in frequency in conjunction with that update.

Now, an update is available from HP titled "HP Software Component 4.1.4.3079. The update appears to fix the "KMODE_EXCEPTION_NOT_HANDLED" error that accompanied the Blue Screen of Death.

The issue seems to be caused by conflicts between Windows Defender and HP software updates. It's unclear how widespread the issue was but affected systems had serious issues. Some systems saw boot loops and couldn't boot into safe mode, according to Windows Latest. If you did manage to boot up your affected PC, you could fix the issue by performing a System Restore. While it doesn't illustrate how widespread the issue is, our executive editor, Daniel Rubino, ran into the issue over the weekend.

Woody Leonhard spotted the HP update and shared the news on Twitter. If you are on an HP device, you can go to Settings and perform a system update to receive the fix from HP. Neowin points out that the fix is rolling out gradually, so you might not see it at this time. The fix doesn't seem to specifically mention fixing this issue, so there's a chance that you could experience the issue after this update. People have reported that the update addressed the issue, though. If you are still concerned, you can follow our guide on how to perform a System Restore.

What you need to know

• Several people are having issues with Windows Defender following a recent update.
• Security Intelligence 1.313.1638.0 seems to cause the issue.
• The only way to fix the issue right now seems to be performing a System Restore.

Updated April 17, 2020: You can now fix the issue by updating Windows Defender. We've added the steps to do so at the bottom of the article.

Another Windows Update is causing issues for people. This time, the bug prevents people from scanning their System using Windows Defender. Windows Latest reported the issue first, including its root cause. While some people are pointing to the update that brought Windows 10 KB4549951, the issue seems to actually be caused by Security Intelligence 1.313.1638.0,, which shipped earlier today.

People online have reported the issue and several people reached out to Windows Latest as well.

When trying to run a security scan, people see an error message that reads, "The threat service has stopped. Restart it now." Another error message that appears states, "Unexpected error. Sorry, we ran into a problem. Please try again." The bug prevents Full and Quick virus scans from running in Windows Defender.

Windows Latest reports that a Microsoft support team staff member confirmed that Microsoft is aware of the issue.

Tom's Hardware reports that you can now fix the issue by updating Windows Defender. The latest updating brings version 1.313.168.0. Here are the steps to update it.

1. Open Windows Search (You can do this by pressing Windows key + 'S').
2. Type Security.
3. Selecct Windows Security.
4. Click Virus & threat protection. Note: You may have to click the hamburger menu to see Virus & threat protection.
5. Click Check for updates (blue text).
6. Click Check for updates (within the box).

What you need to know

• Microsoft Defender ATP is now available in public preview on Linux.
• Microsoft Defender can automatically block attacks and prevent them from starting again.
• Microsoft Defender will also be on Android and iOS by the end of the year.

Microsoft Defender ATP is now available for Linux in public preview. With the preview rollout of Microsoft Defender to Linux, Microsoft Defender is now available on Windows, macOS, and Linux in some form. Microsoft Defender will also be available on iOS and Android by the end of the year.

Microsoft discussed the rollout of Microsoft Defender in preview on Linux as well as the capabilities of Microsoft Defender MTP accross platforms in a recent blog post. The blog post states,

Microsoft summarizes the role of Microsoft Defender ATP in Microsoft doc:

Microsoft aims to provide a "single solution and streamlined view" to people across several platforms. The public preview rollout on Linux extends that streamlined view to yet another operating system.

What you need to know

• Microsoft Defender will come to iOS and Android devices later this year.
• Microsoft Defender on mobile will focus on stopping malware and phishing attacks.
• Microsoft also announced the public preview for Microsoft Defender ATP for Linux today.

Microsoft Defender is on its way to iOS and Android devices. The protection software should be on the mobile platforms by the end of year, according to CNBC. The software will focus on preventing malware and phishing attacks.

CNBC highlights several quotes from Microsoft said in an interview last Thursday. Rob Lefferts, a Microsoft corporate vice president, said that iOS and Android are "pretty safe," stating, "They're pretty safe, but pretty safe is not the same as safe." He also added that "Malware does happen on those platforms."

Lefferts pointed out that Malware can get onto mobile phones when people install applications from insecure sources. He also said that people are subject to phishing attacks. Hackers can provide interfaces that appear to be genuine but instead trick people into exposing their usernames, passwords, and other sensitive data. According to Lefferts, Microsoft Defender could make devices less vulnerable to these types of attacks.

Microsoft mentioned its efforts to bring Microsoft Defender to iOS and Android briefly in a security blog post today. The post doesn't share many details about the efforts, but states that Microsoft will preview their efforts at RSA Conference next week.

News broke this week that Avast has apparently been selling the browsing data of its users to major companies, including Microsoft, Google, Pepsi and Home Depot. The data, which was obtained as part of a report by Motherboard and PCMag, included things like Google searches, what LinkedIn pages and YouTube videos people looked at, and even the porn sites people viewed.

Avast claims the data it collects is anonymized, and its users have to opt in to allow Avast to use their data. However, it's unlikely that every owner included in the around 100 million devices that opted into the program knows exactly how their data is being used and what's being collected. Despite all of the caveats, the fact remains that an antivirus company is harvesting browsing and search data from its users, dumping it off to a subsidiary, and selling it for marketing purposes.

Why even gamble with the idea of yet another company treating your online habits like a sack of money to be pillaged when Windows Defender, which is build into Windows 10, is good enough?

Defender isn't perfect but it's more than good enough

Microsoft has received some backlash in recent years over the telemetry data it collects with Windows 10, but that's a far cry from pulling your entire browsing history and selling it, even if it's anonymized. Otherwise, Windows Defender has a lot going for it: it's fast, and it doesn't hit system resources as hard as heavy third-party antivirus software does. Even better, it's just as good as all of the other antivirus options on the market. And it's free for Windows users.

By opting to stick with Windows Defender, you also avoid all of the annoying parts of third-party antivirus software. It's free, there are no annoying pop-ups to renew your subscription, and you aren't opening yourself up to other potential attack vectors opened up by the way other antivirus software has to integrate itself into your system. Did I mention, it's free for Windows users?

Windows Defender is no cure-all for every problem out there. You'll still want to practice some common sense when poking around the internet, and you might even want to pair it with a malware scanner of some sort to double up on protection. Still, there's no reason to go out of your way with third-party antivirus software when Windows Defender is just fine in its current state.

I don't say all of this as some sort of privacy warrior. I'm well aware that every Google search I make, every trip I map out with my phone's GPS, and every Amazon purchase I make are all going into some marketing black box that is uniquely designed to make me buy more stuff I probably don't need. But when everyone online is looking to make a buck on our data, it only makes sense to cut down where you can.

What you need to know

• Tamper protection detects when an attempt is made to alter security settings.
• Tamper protection is now available in Windows 10 Home and for organizations through Microsoft Intune.
• The feature has been in testing through Insiders since earlier this year but is now generally available.

Hackers and attackers continually try to find new ways to get into computer systems. One tactic is to disable Windows Defender Antivirus. By disabling real-time protection, attackers can get into systems more easily. Microsoft is rolling out a new feature that helps prevent this, tamper protection. The feature detects and prevents unwanted changes to security settings on devices. It's now available in Windows 10 Home and available to organizations through Microsoft InTune.

In a techcommunity post, Microsoft breaks down how tamper protection works and what it aims to stop. The post lists five examples of what tamper protection accomplishes:

1. Real-time protection, which is the core antimalware scanning feature of Microsoft Defender ATP next generation protection and should rarely, if ever, be disabled
2. Cloud-delivered protection, which uses our cloud-based detection and prevention services to block never-before-seen malware within seconds
3. IOAV (IE Downloads and Outlook Express Attachments initiated), which handles the detection of suspicious files from the Internet
4. Behavior monitoring, which works with real-time protection to analyze and determine whether active processes are behaving in a suspicious or malicious way, and then blocks them
5. Security intelligence updates, which Windows Defender Antivirus uses to detect the latest threats

For Windows 10 Home users, tamper protection will be turned on by default. The feature is being turned on gradually. Users can use the Windows Security app to review or change settings for tamper protection.

Organizations can deploy tamper protection through MIcrosoft Intune. Organizations can enable the feature for an entire organization or individual devices and user groups.

What you need to know

• The latest version of Windows Defender has a bug that causes Quick and Full scans to fail.
• Real time scanning still works for Windows Defender despite the bug.
• Microsoft confirmed that the company is working on a fix.

The latest version of Windows Defender has a bug that will cause Quick and Full scans to fail after only a few seconds and scanning only a small number of files (via ZDNet). The bug affects Windows Defender version 4.18.1908.7 and later. Several users reported the issue on Microsoft support forums as well as Reddit.

Windows Defender version 4.18.1908.7 was released earlier this week. The bug causing scans to fail was introduced while Microsoft attempted to fix a separate bug in the July 2019 Patch Tuesday update.

In addition to Windows Defender on Windows 10, the bug affects all versions of Windows Defender on all versions of Windows. As pointed out by ZDNet, the bug also affects Security Essentials.

Microsoft confirmed to ZDNet that the company is working on a fix for the bug. Microsoft pointed out that real-time scanning protection still works despite the bug and that malware should be detected in real-time.

If you'd like to scan your system while the bug is still affecting Windows Defender, you can still perform a Custom scan with the tool.

What you need to know

• Microsoft Defender ATP is now in open preview for IT professionals to check out.
• The cross-platform support allows IT pros to manage Macs with a similar interface to Microsoft Defender ATP on Windows.
• Microsoft Defender ATP can be enabled by customers who have turned on preview features in the oboarding section of Microsoft Defender Security Center, Microsoft says.

Microsoft this week announced that Microsoft Defender ATP for Mac is now in open public preview. The threat management solution first launched in a limited preview in March, and it allows IT pros to manage Mac devices alongside their Windows deployments from a similar user interface.

Microsoft Defender ATP can be installed on Macs running MacOS Mojave, High Sierra, and Sierra. Macs with the app installed will be able to use it to run full malware scans, review threats that have been detected, and take action on threats. More advanced settings include:

• Disabling or enabling real-time protection, cloud-delivered protection, and automatic sample submission
• Adding exclusions for files and paths
• Managing notifications when threats are found
• Manually checking for security intelligence updates

Further, when any machines detect an issue, IT managers will be able to the alerts in the Microsoft Defender ATP portal and dive deeper into detailed information about each detection.

Microsoft Defender ATP for Mac can be turned on for customers who have enabled preview features through the Microsoft Defender Security Center.

Cheap PC accessories we love

Take a gander at these awesome PC accessories, all of which will enhance your Windows experience.

Anker 4 port USB 3.0 hub ($10 at Amazon)

Whether on a desktop or laptop PC, you always need more ports to connect things to. This hub gives you an additional four USB 3.0 Type A ports.

Ikea Fixa Cable Management System ($11 at Amazon)

This IKEA cable management kit is your ticket to a clean setup. It's simple and functional.

NZXT Puck ($20 at Amazon)

This clever little accessory has powerful magnets on the rear to make it stick to any of the metal panels on your PC case or anything else. It's great for hanging accessories like headsets.

Microsoft's own security solution has come a long way since it was first introduced. Starting off as a security package that simply did not match already established anti-virus solutions, the company continued to develop, evolve and update Windows Defender, which is now quite the capable suite. You can safely rely on Microsoft to protect your PC to some degree, as you can with any offering, but not everyone has trust in Redmond.

When installing Windows 10 (or buying a laptop or tablet), you'll be rocking Windows Defender out-the-box. Community member Jcmg62 took to our forum to ask if anyone is having issues using it.

Personally, I rock Windows Defender without issue. After some time (usually a week or so) I'll run a full scan using a free tool like Malwarebytes, but Defender is on point all the time, removing anything that gets through active protection. Is it perfect? Not at all, no security software is, but Defender for me is an unintrusive security suite that lets you get on with daily tasks (and gaming) without hopping through hoops.

What say you? Do you use Windows Defender or do you prefer to trust a company like Symantec?

From the forum: Windows Defender Security - Is it Enough?

Microsoft is reaching out to Chrome users with a new browser extension designed to help protect them against online threats as they browse the web. Called Windows Defender Browser Protection, the extension promises to shield users from a number of potential online threats by warning about links in phishing emails and malicious websites.

"The Windows Defender Browser Protection extension for Google Chrome allows you to add an additional layer of protection when browsing online, powered by the same trusted intelligence found in Microsoft Edge," Microsoft says. "The extension alerts you about known malicious links, and gives you a clear path back to safety."

The extension works by matching links against a constantly updated list of known malicious URLs. If a link matches one on the list, Windows Defender Browser Protection will flash a red warning screen, alerting users that the website is known to be malicious.

It's an interesting move, to be sure – particularly because Chrome already offers this sort of protection on its own. However, Microsoft claims that the phishing protection offered by Microsoft Edge is effective against 99 percent of attacks, compared to 87 percent and 70 percent for Chrome and Firefox, respectively. Since, according to Microsoft, the Chrome extension relies on the same backbone as Edge, then there's an argument for adding it as an extra layer of protection.

In any case, if you're a Chrome user, you can pick up Windows Defender Browser Protection from the Chrome web store now.

Windows Defender helped to prevent "massive" coin mining malware outbreak from spreading earlier this week. According to Microsoft{.nofollow}, the campaign attempted to infect nearly 500,000 computers throughout a 12-hour period, beginning just before noon on March 6.

The trojans, identified by Microsoft as variants of Dofoil (or Smoke loader), attempted to deliver a payload of cryptocurrency coin mining components. The majority of attacks, 73 percent, were detected in Russia, but significant activity was also detected in Turkey and Ukraine.

According to Microsoft, its machine learning models enabled it to begin blocking the threats within milliseconds of being flagged by Windows Defender.

• Within milliseconds, multiple metadata-based machine learning models in the cloud started blocking these threats at first sight.
• Seconds later, our sample-based and detonation-based machine learning models also verified the malicious classification. Within minutes, detonation-based models chimed in and added additional confirmation.
• Within minutes, an anomaly detection alert notified us about a new potential outbreak.
• After analysis, our response team updated the classification name of this new surge of threats to the proper malware families. People affected by these infection attempts early in the campaign would have seen blocks under machine learning names like Fuery, Fuerboos, Cloxer, or Azden. Later blocks show as the proper family names, Dofoil or Coinminer.

It's unclear if this attack would have reached the scale of 2017's massive WannaCry attack, but this is an interesting example of Microsoft's work with Windows Defender Advanced Threat Protection (ATP) in action.

Microsoft says that Windows 10, Windows 8.1, and Windows 7 machines running Windows Defender or Microsoft Security Essentials are protected from the outbreak.

Microsoft has announced that it will soon add support for Windows 7 and Windows 8.1 to Windows Defender Advanced Threat Protection (ATP). Previously only available as a threat-detection service for Windows 10, Windows Defender ATP will support Endpoint Detection and Response (EDR) functionality on Windows 7 and Windows 8.1 devices.

Windows Defender ATP is expected to be available for Windows 7 Service Pack 1 and Windows 8.1 starting this summer, but a public preview will be available starting this spring. However, Windows Defender ATP will onyl be available for Windows 7 and 8.1 for customers who are in the process of moving to Windows 10. The goal, Microsoft says, is to give security teams a way to keep an eye on all of their systems even if some are still waiting to be upgraded.

According to Microsoft, Windows Defender ATP can be run alongside third-party antivirus solutions, but the company recommends using it alongside Windows Defender Antivirus.

As businesses continue their Migration to Windows 10, the expansion of Windows Defender ATP to Windows 7 and 8.1 is sure to be welcome. The move should make the transition simpler by providing administrators with a single point to keep an eye on security threats across their environment. This also comes jsut a few months after Microsoft announced that Windows Defender ATP will soon be able to monitor threats across macOS, Linux, iOS, and Android.

Starting in March, Windows Defender will begin detecting and removing "cleaner" and "optimizer" applications that use coercive messages to scare people into upgrading to their paid versions. The programs in question typically offer to scan and discover problems with their free version, then ask users to pay to fix any problems that they purport to find, often with messages intended to scare.

The move comes in response to a rise in the number of these programs, Microsoft says in a new blog post. The company has updated its evaluation criteria to include the following:

• Programs must not display alarming or coercive messages or misleading content to pressure you into paying for additional services or performing superfluous actions.
• Software that coerces users may display the following characteristics, among others:
• Reports errors in an exaggerated or alarming manner about the user's system and requires the user to pay for fixing the errors or issues monetarily or by performing other actions such as taking a survey, downloading a file, signing up for a newsletter, etc.
• Suggests that no other actions will correct the reported errors or issues
• Requires the user to act within a limited period of time to get the purported issue resolved

Microsoft says that it began requiring cleaner and optimizer programs to provide detailed reports on what they claim needs to be fixed, starting in February of 2016. The goal, Microsoft says, is to prevent such programs from simply stating that there are a number of errors without giving customers information about what's alleged to be wrong.

Windows Defender will begin classifying these programs as "unwanted software" and removing them starting on March 1.

As part of a partnership with Bitdefender, Lookout, and Ziften, Windows Defender ATP will soon be able to detect threats across macOS, Linux, iOS, and Android. For businesses that employ a number of different devices, this will help to consolidate the detection a response to security threats across their whole fleet.

"Windows Defender ATP provides security teams a single pane of glass for their endpoint security and now by collaborating with these partners, our customers can extend their ATP service to their entire install base," Microsoft says.

Microsoft has accomplished this with new integrations with Bitdefender, Lookout, and Ziften. Once toggled on, Microsoft says, the Windows Defender ATP console will surface new events from on-boarded macOS, Linux, iOS, and Android devices. From Microsoft:

• Bitdefender's GravityZone Cloud enables customers to view comprehensive threat intelligence information on malware and suspicious files, such as threat type, threat category, and many other relevant details.
• Lookout Mobile Endpoint Security gives customers real-time visibility into incidents on mobile devices and lets them respond quickly and effectively.
• Ziften's Zenith systems and security operations platform helps customers to detect attacks and zero-day exploits, to uncover the full scope of a breach, and to quickly respond to contain attacks.

According to Microsoft, the Bitdefender integration is now available in public preview. Ziften and Lookout are expected to join the public preview program soon.

Windows Defender Advanced Threat Protection (ATP) for the Windows 10 Fall Creators Update is now in public preview, Microsoft has announced. The preview includes a new set of features for businesses, first announced earlier in 2017, that are meant to add improved security and threat protection across the board.

The main thrust of the latest Windows Defender ATP improvements is that ATP will now include "seamless integration across the entire Windows threat protection stack." Says Microsoft:

The improvements mean that administrators will be given greater insight into detections, alerts, and analytics. That includes a new security analytics dashboard view that can help spot configuration issues and machines with misconfigured or out of date security settings. Organizations can also now tap into customized reports, access data via APIs, and more.

For a full rundown, check out Microsoft's detailed rundown of all of what's new in the Windows Defender ATP public preview. Anyone who cares to try out all of what's new can sign up for a 90-day free trial as well.

Following recent complaints from antivirus firm Kaspersky regarding what it sees as anticompetitive practices in Windows 10, Microsoft has taken to a blog post to outline its approach to antivirus coverage. And while the post doesn't mention Kaspersky by name, it does address one the bigger complaints levied at Microsoft (via The Verge).

In a recent blog post accompanying its filing of antitrust complaints in the EU, Kaspersky stated that one of its main issues concerned Microsoft's practice of removing third-party antivirus software after an update if it is deemed incompatible. In its place, Windows Defender is switched on in order to maintain constant coverage. Though Microsoft claims around 95 percent of PCs already had compatible antivirus software installed when moving to the most recent Windows 10 feature update, the Creators Update, the company did acknowledge that a certain portion of applications were disabled.

One of Kaspersky's other central complaints was that Microsoft doesn't give software vendors enough time to ensure their applications are compatible with major updates before they are released. Microsoft's response doesn't exactly directly combat this point, but the company does note that it is actively engaged with other vendors.

Microsoft's defense comes from its position that Windows 10 users should have always-on protection. As it explains, that involves using the built-in Windows Defender as a fallback when any third-party antivirus is out of date or expired. Despite its stated intentions, that approach is apparently leading to some of the friction described in Kaspersky's recent blog post.

Updated June 6, 2017: Updated with a statement from Microsoft on the matter.

Original Story: Kaspersky Lab has moved to file an antitrust complaint against Microsoft in Europe over what it sees as unfair practices to promote Windows Defender over competing products in Windows 10. In a blog post, co-founder of the Russian firm, Eugene Kaspersky, lays out several complaints that, he says, highlight "questionable tactics" on Microsoft's part to give its own antivirus solution an unfair advantage (via The Verge).

From Kaspersky:

Kaspersky's complaints include accusations that Microsoft removes its software from users' PCs when they upgrade to Windows 10, turning to Windows Defender in its place. The stated reason is compatibility issues, but Kaspersky claims Microsoft doesn't afford third-party antivirus developers enough time with an update's RTM release to update their software ahead of a broad rollout.

In its complaint, Kaspersky says it is seeking to stop Microsoft from "misleading and misinforming" users in order to keep security software "on a level playing field" on the Windows Platform.

For its part, a Microsoft spokesperson reached out to Windows Central with the following statement:

Microsoft has announced the next step the company has taken to offer enhanced security for enterprise. Called Windows Defender Advanced Threat Protection, this new service will aid enterprise customers in detecting, investigating and responding to advanced attacks on network infrastructure.

From the company's rather in-depth blog post:

Initial shielding comes from "the world's largest array of sensors" to enable threat protection that provides information on who, what and why an attack occurred. It's quite the operation, taking into account vast amounts of data accumulated which is then augmented by experts and "hunters" to detect said attacks.

Once an attack has been detected, the Windows Defender Advanced Threat Protection service will the provide detailed analysis as well as recommendations on how to most effectively respond. Files and URLs can even be submitted to isolated virtual instances for further examination.

The best part of this new service for enterprise is how it's being built into Windows 10 and thus eliminates any costs and potential issues with deployment. It's also complimentary to existing Microsoft security services, like those found in Office 365 and Microsoft Advanced Threat Analytics. More details can be found on the official blog post.

An offline version of Windows Defender has been spotted in the Windows 10 Insider Preview. If you're rocking build 14271, it's possible to reboot the installation into a more secure mode to begin scanning the PC for threats to be removed without requiring the program to be on external storage.

There'll be a new option in the Settings app (under Security + Updates > Windows Defender) that will allow you to select "Scan Offline". This will cause the system to reboot and is estimated to take around 15 minutes to complete. It's a neat feature for those who choose Defender as their main line of protection.

Source: Comms1; via: WinCore.ru; Thanks, @craftuser, for the tip!