Yellow triangle in Windows Security (Defender)

Bree · Jul 22, 2021

maurice naggar said:
Are you able to click the button to ON ? ( for sample submission)

Yes, and it stays on until the next Restart.

BunnyJ · Jul 22, 2021

I just had to do a restart and defender stayed on.. I did a clean instillation and that could be one of the reasons why it's staying on.

maurice naggar · Jul 22, 2021

@Bree
ok. It now seems to me that what is involved now ( about submiting suspicious files) is one of the other settings in the preferences for Windefend service.
Go back into a Elevated Powershell. Copy > paste this onto Powershell window

Code:

Set-MpPreference -SubmitSamplesConsent SendAllSamples

Tap Enter.
Observe result. Then tell me the behaviors after that.

Bree · Jul 22, 2021

maurice naggar said:
@Bree
ok. It now seems to me that what is involved now ( about submiting suspicious files) is one of the other settings in the preferences for Windefend service.
Go back into a Elevated Powershell. Copy > paste this onto Powershell window

Code:

Set-MpPreference -SubmitSamplesConsent SendAllSamples

Tap Enter.
Observe result. Then tell me the behaviors after that.

That does turn it on, but it's off again after a Restart.

maurice naggar · Jul 22, 2021

Question: Does this pc have a third-party add-on of any sort, to tweak or "adjust" ? like perhaps from O & O or some other ?

Bree · Jul 22, 2021

maurice naggar said:
Question: Does this pc have a third-party add-on of any sort, to tweak or "adjust" ? like perhaps from O & O or some other ?

None whatsoever - I don't hold with 3rd-party tweakers, not now in W11 and never used them in W10. Over on Ten Forums I've seen too many obscure problems, some with Windows Update, that had an incautious tweak as the root cause. Me I've stuck with pure MS AV and only customised within the limits of MS Settings - never had any Windows Update issues, not since first getting W10 in 2015 :wink:

BunnyJ · Jul 22, 2021

Bree said:
None whatsoever - I don't hold with 3rd-party tweakers, not now in W11 and never used them in W10. Over on Ten Forums I've seen too many obscure problems, some with Windows Update, that had an incautious tweak as the root cause. Me I've stuck with pure MS AV and only customised within the limits of MS Settings - never had any Windows Update issues, not since first getting W10 in 2015

The users that tweak their setting and wonder why things no longer work drive my crazy. No.. you don't know more that the programmers at MS .. just leave it alone.,.

Bree · Jul 22, 2021

For reference, the machine I'm running W11 on is System Two in 'My Computers' below, a machine below the MS minimum requirement. However, I have the same issues in my System One that's running in a Hyper-V VM that meets all the requirements with virtual hardware.

Dru2 · Jul 22, 2021

maurice naggar said:
Question: Does this pc have a third-party add-on of any sort, to tweak or "adjust" ? like perhaps from O & O or some other ?

I can't speak for anyone else, but I suspect the issue is not third party add-ons, certainly not in my case - only using Microsoft Security (Defender), don't have any tweak apps installed.

Anyway, oddly enough my settings now stick after reboot on both my laptop and desktop - nothings changed other then the normal defender updates. Still the same OS version - .71

BunnyJ · Jul 22, 2021

Dru2 said:
I can't speak for anyone else, but I suspect the issue is not third party add-ons, certainly not in my case - only using Microsoft Security (Defender), don't have any tweak apps installed.

Anyway, oddly enough my settings now stick after reboot on both my laptop and desktop - nothings changed other than the normal defender updates.

Me too.. I just use defender and no other apps or changes/modifications to defender. I get the usual updates and it just turns on when I boot my PC.

YMMV as usual

Bree · Jul 22, 2021

Dru2 said:
I can't speak for anyone else, but I suspect the issue is not third party add-ons, certainly not in my case - only using Microsoft Security (Defender), don't have any tweak apps installed.

Anyway, oddly enough my settings now stick after reboot on both my laptop and desktop - nothings changed other then the normal defender updates. Still the same OS version - .71

Are you sure nothing has changed? Another who reported that it now works also said there was a Platform update. Mine still doesn't survive a restart, but then I've not been offered the update yet, I'm still on Engine Version: 1.1.18300.4.

Today, Automatic Sample Submission was enabled at machine start. Restarted a few times, it stayed enabled.

MS telemetry at work maybe. I ain't complaining this time.

Edit: There's a new version of the Platform: 1.1.18400.4. Could that have been the fix? Anyone know where a changelog would be?

Automatic Sample Submission is Off?

Just Ignore it, not much one can do, one would think that a company like KS would be concerned with something dealing with security???

www.elevenforum.com

maurice naggar · Jul 22, 2021

@Bree Let's see about doing a manual update run for Windefend & then lets get a different report.
In a Elevated Powershell, Copy >> Paste this into the Powershell window

Code:

Update-MpSignature

tap Enter.
This should do a update check for latest Windefend definitions.
Exit powershell when done.
.
Then run this report. This is a readout report only. It does not make any changes.
Download SecurityCheck by glax24 from here https://tools.safezone.cc/glax24/SecurityCheck/SecurityCheck.exe

and save the tool on the desktop.

If Windows's SmartScreen block that with a message-window, then

Click on the MORE INFO spot and over-ride that and allow it to proceed.

This tool is safe. Smartscreen is overly sensitive.

Right-click with your mouse on the Securitycheck.exe and select "Run as administrator" and reply YES to allow to run & go forward
Wait for the scan to finish. It will open in a text file named SecurityType.txt. Close the file. Attach it with your next reply.

You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

Dru2 · Jul 22, 2021

Bree said:
Are you sure nothing has changed? Another who reported that it now works also said there was a Platform update. Mine still doesn't survive a restart, but then I've not been offered the update yet, I'm still on Engine Version: 1.1.18300.4.

As stated - "nothings changed other then the normal defender updates. Still the same OS version - .71" - that is since my initial post last Saturday (17 July), nothing's changed outside the normal spate of definition updates on both machines. Not sure what else I can say

Virus Definition Updates...

Laptop Update History....

I can't explain it, I only know the issue is now gone - when I reboot the settings stick to on.

Windows 11 Pro 21H2 Build 22000.71. Insiders Dev channel in-place install.

Bree · Jul 22, 2021

maurice naggar said:
This should do a update check for latest Windefend definitions.
Exit powershell when done.
.
Then run this report....

Done.

Code:

SecurityCheck by glax24 & Severnyj v.1.4.0.53 [27.10.17]
WebSite: www.safezone.cc
DateLog: 22.07.2021 19:35:06
Path starting: C:\Temp\SC\SecurityCheck.exe
Log directory: C:\SecurityCheck\
IsAdmin: True
User: Owner
VersionXML: 8.93is-22.07.2021
___________________________________________________________________________

Windows 10(6.3.22000) (x64) Professional Release: 2009 Lang: English(0809)
Installation date OS: 10.07.2021 01:01:38
LicenseStatus: Windows(R), Professional edition The machine is permanently activated.
Boot Mode: Normal
Default Browser: C:\Program Files\Mozilla Firefox\firefox.exe
SystemDrive: C: FS: [NTFS] Capacity: [232.7 Gb] Used: [25.9 Gb] Free: [206.8 Gb]
------------------------------- [ Windows ] -------------------------------
Internet Explorer 11.1.22000.0 [color=red][b]Warning! [url=https://www.catalog.update.microsoft.com/Search.aspx?q=KB4601319]Download Update[/url][/b][/color]
User Account Control [b]enabled[/b] (Level 3)
Automatically download and schedule installation
Notify before download
Security Center (wscsvc) - The service is running
Remote Registry (RemoteRegistry) - The service has stopped
SSDP Discovery (SSDPSRV) - The service is running
Remote Desktop Services (TermService) - The service has stopped
Windows Remote Management (WS-Management) (WinRM) - The service has stopped
---------------------------- [ Antivirus_WMI ] ----------------------------
Windows Defender (enabled and up to date)
--------------------------- [ FirewallWindows ] ---------------------------
Windows Defender Firewall (mpssvc) - The service is running
--------------------------- [ OtherUtilities ] ----------------------------
Microsoft OneDrive v.21.119.0613.0001
------------------------------ [ ArchAndFM ] ------------------------------
7-Zip 19.00 (x64) v.19.00
-------------------------- [ IMAndCollaborate ] ---------------------------
Zoom v.5.4.9 (59931.0110) [color=red][b]Warning! [url=https://zoom.us/client/latest/ZoomInstaller.exe]Download Update[/url][/b][/color]
-------------------------------- [ Media ] --------------------------------
VLC media player v.3.0.7.1 [color=red][b]Warning! [url=https://www.videolan.org/vlc/download-windows.html]Download Update[/url][/b][/color]
HandBrake 1.1.1 v.1.1.1 [color=red][b]Warning! [url=https://handbrake.fr/downloads.php]Download Update[/url][/b][/color]
Windows Movie Maker v.3.1 [b][color=red]Warning! This software is no longer supported.[/color][/b]
------------------------------- [ Browser ] -------------------------------
Mozilla Firefox (x64 en-GB) v.90.0.2
Microsoft Edge v.91.0.864.71
----------------------------- [ EmailClient ] -----------------------------
Windows Live Essentials v.16.4.3528.0331 [b][color=red]Warning! This software is no longer supported.[/color][/b]
------------------ [ AntivirusFirewallProcessServices ] -------------------
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2106.6-0\MsMpEng.exe v.4.18.2106.6
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2106.6-0\NisSrv.exe v.4.18.2106.6
Microsoft Defender Antivirus Service (WinDefend) - The service is running
Microsoft Defender Antivirus Network Inspection Service (WdNisSvc) - The service is running
----------------------------- [ End of Log ] ------------------------------

maurice naggar said:
If Windows's SmartScreen block that with a message-window....

I think you'll find that the only objection SmartScreen raises is that the .exe is marked as coming from another computer and needs to be unblocked first.

maurice naggar · Jul 22, 2021

F Y I per Latest security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware - Microsoft Security Intelligence
as of this star-date / star-time
The latest security intelligence update is:

Version: 1.343.1470.0
Engine Version: 1.1.18300.4
Platform Version: 4.18.2106.6
Released: 7/22/2021 2:55:47 PM

maurice naggar · Jul 22, 2021

@Bree Do look at the content of the SecurityCheck report. There are 3 apps that need updates to the latest release version { Zoom, VLC Meida Player & Handbrake). There are 2 no longer supported apps listed.
.
The report shows that Microsoft Defender protections are running ( active).
If you are still having a "yellow flag" notice then it seems "some thing" ( some factor) is switching things back when a "Restart" is done.

It had not occured to me before, BUT, do you has "FAST startup" set on this Windo0ws installation ?
If yes, then I would suggest to set it to OFF. see Turn On or Off Fast Startup in Windows 10
Fast startup is known to cause unforseen quirky effects in different security related cases.

Bree · Jul 22, 2021

maurice naggar said:
The report shows that Microsoft Defender protections are running ( active).
If you are still having a "yellow flag" notice then it seems "some thing" ( some factor) is switching things back when a "Restart" is done.

Let's see if this fixes it.....

Dru2 · Jul 22, 2021

@Bree, what version of 11 are you running? Also did you clean install or upgrade via Insiders?

BTW, I'm not running anything in VM. Simply a live machine to see how apps and stuff perform in real life.

Thanks.