Sponsor Content Created With Microsoft

Troubleshoot common Windows 11 Pro security alerts and what to do next

Features

Windows 11 Pro keeps your PC safe through a sophisticated suite of tools. Here's how to respond to common alerts.

Windows interface displaying Windows Security dashboard and Microsoft Defender alerts.
(Image credit: Future)

Windows 11 Pro includes a built-in safety net known as Windows Security, and despite the simple name, it's a powerful collection of tools designed to keep your PC safe.

Because Windows Security is always on the job, providing real-time protection, there's a good chance you'll eventually see some form of safety alert pop up.

While these alerts can be frightening, knowing how to handle them is key to keeping your PC and your data safe. Here's what you need to know about common Windows 11 Pro security alerts.

1. How to troubleshoot "Turn on virus protection" or "Real-time protection is off" alerts

An alert letting me know that Defender Antivirus is disabled on my PC. (Image credit: Future)

Seeing this alert pop up in the bottom-right corner of your Windows desktop means that your Windows Defender real-time protection has been disabled.

This alert can show up when you install or uninstall a third-party antivirus option, or it could show up when something more serious is afoot.

The solution, which involves turning Defender's real-time protection back on, is simple.

  1. Launch Windows Security.
  2. Click Turn on in the Virus & threat protection section.
  3. Click Yes in the window that pops up.

Note that if you did just install a third-party antivirus, re-enabling Defender's real-time protection can interfere. Ensure that your third-party AV is indeed offering its own version of real-time protection to remain secure.

2. How to troubleshoot "Threat found" or "Threat found - action needed" alerts

Windows Security alert letting me know a threat was found on my PC. (Image credit: Future)

These are more serious alerts that show up when Windows Defender recognizes a possible threat on your PC. It could end up being benign, or it could be a real issue.

Either way, you want to deal with these alerts promptly. Here's how, starting with "Threat found - action needed."

  1. Launch Windows Security.
  2. Click Virus & threat protection.
  3. Click Protection history.
  4. Click the Threat blocked option in the list.
  5. Click the Actions dropdown menu.

Clicking the "Actions" dropdown menu here lets you choose how to handle the threat. (Image credit: Future)

You should now see a couple of options: Quarantine and Allow on device. Unless you're absolutely sure that the file is not malware, you should choose to quarantine.

In some cases, Defender will make the decision for you, quarantining or blocking the file automatically. In these cases, you'll only have the option to allow the file from the dropdown Action menu.

Once quarantined, you can choose to Remove the file completely from your PC.

Should you allow the potential threat and want to reverse the action, follow these steps.

  1. Launch Windows Security.
  2. Click Virus & threat protection.
  3. Click Allowed threats.
  4. Click Remove.

3. How to troubleshoot "Threat quarantined" or "Threat blocked" alerts

Sometimes Windows 11 will quarantine a threat, allowing you to choose how to handle it. (Image credit: Microsoft)

Windows may decide to take further actions on your behalf if a file is particularly dangerous or well-known to be malware.

A Threat quarantined alert means Defender has placed a file into quarantine. From here, you can follow the steps in the previous section to either remove or allow the file.

A Threat blocked alert means Defender blocked the file and removed it from your PC. There's no action required on your part, but you can always check Windows Security's Virus & threat protection section for more information.

It's always a good idea to discover how the threat made it onto your PC in the first place in order to avoid the same issue in the future.

4. How to troubleshoot "Remediation incomplete" alerts

Sometimes Defender will fail to solve an issue and will require input on your part to proceed. (Image credit: Microsoft)

Windows Defender will sometimes attempt to quarantine or remove a threat but fail in the process. This is when you will see a Remediation incomplete alert show up.

Here's what you should do next.

  1. Launch Windows Security.
  2. Click Virus & threat protection.
  3. Click Protection history.
  4. Click the threat that caused the alert.

From here you can choose which specific actions you want Defender to take in order to solve the issue.

5. How to troubleshoot SmartScreen alerts

SmartScreen in action blocking access to a potentially harmful site. (Image credit: Future)

Windows 11 Pro's Defender SmartScreen tool is designed to block access to malicious websites and downloads, as well as to protect against phishing ploys. Unlike Smart App Control, SmartScreen can be bypassed relatively easily.

SmartScreen is baked into Windows 11 and into the Edge browser, and it will stop you with a bright red warning when it recognizes a site or a file that's potentially suspicious.

If SmartScreen blocks a website, you'll see a red page with a Close page option prominently displayed. If you're certain the site is safe, you can click the More information dropdown menu to report the site as safe or to continue to the site despite the risks.

SmartScreen blocked these unsafe files from downloading. (Image credit: Future)

Downloads blocked by SmartScreen will appear in Edge's Downloads menu. These files can be deleted using the Trash icon, or you can choose from a number of other options (like keeping the file anyway, which isn't recommended) by clicking the three-dot menu button next to the blocked file.

6. How to troubleshoot "This app has been blocked" alerts

Smart App Control keeps dangerous apps away from your PC. (Image credit: Future)

Windows 11's Smart App Control tool is designed to block malicious, untrusted, or unsigned apps from being installed on your PC. Unlike SmartScreen, which is more like a warning system you can bypass, Smart App Control is all or nothing.

Smart App Control is also great at notifying you if an app you're attempting to install is going to slow down your PC, install extra software, or display a ton of ads.

If an alert pops up telling you that "This app has been blocked", chances are high that it's not worth installing on your PC.

There is currently no method to bypass Smart App Control on a per-app basis without completely disabling the feature. Only disable Smart App Control if you are 100% certain that the app in question is not malicious.

Windows 11's Smart App Control settings can be found in Windows Security > App & browser control > Smart App Control settings.

Cale Hunt
Cale Hunt
Contributor

Cale Hunt brings to Windows Central more than nine years of experience writing about PC gaming, Windows laptops, accessories, and beyond. If it runs Windows or in some way complements the hardware, there’s a good chance he knows about it, has written about it, or is already busy testing it.