Yellow triangle in Windows Security (Defender)

Dru2 · Jul 22, 2021

Bree said:
I'm not an Insider. I did an in-place upgrade from W10 using an ISO from UUPDump.

Yeah, I didn't go the clean install route since I didn't want to have to reinstall all my apps and other software. Also wanted to know if it would complain or boot something out.

Anyway, looks like I was just offered .100; downloading now. We'll see if any changes occur after.

Bree · Jul 22, 2021

Dru2 said:
I didn't go the clean install route since I didn't want to have to reinstall all my apps and other software. Also wanted to know if it would complain or boot something out.

I have the luxury of having more than one machine, so I could afford the risk of upgrading one of them to W11, leaving the rest on W10 until W11 goes RTM.

Alex__ASSR · Jul 22, 2021

Dru2 said:
Windows 11 Pro 21H2 Build 22000.71. Insiders Dev channel in-place install.

So on my backup desktop (system two) every time I boot / re-boot I get a yellow exclamation triangle in Windows Security under Virus & threat protection. I can click the "Turn on" button and all is good until I reboot. When I reboot I get the same issue... a yellow triangle.

View attachment 3383

At first I thought it was something particular to the backup system, but I just updated my laptop using the same method - Insiders Dev channel in-place update and get the exact issue.

Anyway one else getting this? Did you solve it? How?

Thanks

same problem here.

Dru2 · Jul 22, 2021

Bree said:
I have the luxury of having more than one machine, so I could afford the risk of upgrading one of them to W11, leaving the rest on W10 until W11 goes RTM.

So do I. I did install on my backup system but I rarely use it. Since I use my laptop just as much as my main rig, it makes the perfect candidate to see Windows 11 used a in a real world environment. Again, why I noticed the battery performance.

Anyway, I just updated to .100. Still no further issues with Windows Security and yellow triangles. All good here :)

@Alex__ASSR, my issue seems to have resolved itself. You might read through the last few pages to see if anything sticks out for you.

Good luck.

maurice naggar · Jul 22, 2021

My last tip ( sadly) ....and as I noted before ....
Does this installation have "FAST startup" set on this system ?
If yes, then I would suggest to set it to OFF. see Turn On or Off Fast Startup in Windows 10
Fast startup is known to cause unforseen quirky effects in different security related cases.

Wynona · Jul 23, 2021

Stupid virus & protection yellow triangle is back the minute I restarted from the update! I'm not going to restart it yet.

Wynona · Jul 23, 2021

@maurice naggar, the yellow triangle is back after the update to Windows 11 22000.100.

Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

Install the latest PowerShell for new features and improvements! Migrating from Windows PowerShell 5.1 to PowerShell 7 - PowerShell

PS C:\WINDOWS\system32> get-mppreference

AllowDatagramProcessingOnWinServer : False
AllowNetworkProtectionDownLevel : False
AllowNetworkProtectionOnWinServer : False
AttackSurfaceReductionOnlyExclusions :
AttackSurfaceReductionRules_Actions :
AttackSurfaceReductionRules_Ids :
CheckForSignaturesBeforeRunningScan : False
CloudBlockLevel : 1
CloudExtendedTimeout : 1
ComputerID : 8DB9679D-E7F1-4D48-AEF2-5CA558B81DE9
ControlledFolderAccessAllowedApplications :
ControlledFolderAccessProtectedFolders :
DisableArchiveScanning : False
DisableAutoExclusions : False
DisableBehaviorMonitoring : False
DisableBlockAtFirstSeen : False
DisableCatchupFullScan : True
DisableCatchupQuickScan : True
DisableCpuThrottleOnIdleScans : True
DisableDatagramProcessing : False
DisableDnsOverTcpParsing : False
DisableDnsParsing : False
DisableEmailScanning : True
DisableGradualRelease : False
DisableHttpParsing : False
DisableInboundConnectionFiltering : False
DisableIntrusionPreventionSystem :
DisableIOAVProtection : False
DisableNetworkProtectionPerfTelemetry : False
DisablePrivacyMode : False
DisableRdpParsing : False
DisableRealtimeMonitoring : False
DisableRemovableDriveScanning : True
DisableRestorePoint : True
DisableScanningMappedNetworkDrivesForFullScan : True
DisableScanningNetworkFiles : False
DisableScriptScanning : False
DisableSshParsing : False
DisableTlsParsing : False
EnableControlledFolderAccess : 0
EnableDnsSinkhole : False
EnableFileHashComputation : False
EnableFullScanOnBatteryPower : False
EnableLowCpuPriority : False
EnableNetworkProtection : 0
EngineUpdatesChannel : 0
ExclusionExtension :
ExclusionIpAddress :
ExclusionPath :
ExclusionProcess : {C:\Program Files\FreeFileSync\Bin\*}
ForceUseProxyOnly : False
HighThreatDefaultAction : 0
LowThreatDefaultAction : 0
MAPSReporting : 2
MeteredConnectionUpdates : False
ModerateThreatDefaultAction : 0
PlatformUpdatesChannel : 0
ProxyBypass :
ProxyPacUrl :
ProxyServer :
PUAProtection : 1
QuarantinePurgeItemsAfterDelay : 90
RandomizeScheduleTaskTimes : True
RealTimeScanDirection : 0
RemediationScheduleDay : 0
RemediationScheduleTime : 02:00:00
ReportingAdditionalActionTimeOut : 10080
ReportingCriticalFailureTimeOut : 10080
ReportingNonCriticalTimeOut : 1440
ScanAvgCPULoadFactor : 50
ScanOnlyIfIdleEnabled : True
ScanParameters : 1
ScanPurgeItemsAfterDelay : 15
ScanScheduleDay : 0
ScanScheduleQuickScanTime : 00:00:00
ScanScheduleTime : 02:00:00
SchedulerRandomizationTime : 4
SevereThreatDefaultAction : 0
SharedSignaturesPath :
SignatureAuGracePeriod : 0
SignatureBlobFileSharesSources :
SignatureBlobUpdateInterval : 60
SignatureDefinitionUpdateFileSharesSources :
SignatureDisableUpdateOnStartupWithoutEngine : False
SignatureFallbackOrder : MicrosoftUpdateServer|MMPC
SignatureFirstAuGracePeriod : 120
SignatureScheduleDay : 8
SignatureScheduleTime : 01:45:00
SignaturesUpdatesChannel : 0
SignatureUpdateCatchupInterval : 1
SignatureUpdateInterval : 0
SubmitSamplesConsent : 0
ThreatIDDefaultAction_Actions :
ThreatIDDefaultAction_Ids :
TrustLabelProtectionStatus : 0
UILockdown : False
UnknownThreatDefaultAction : 0
PSComputerName :

PS C:\WINDOWS\system32>

AndreTen · Jul 23, 2021

@Wynona Maybe you should mask your computer ID. Not critical, just precaution

maurice naggar · Jul 23, 2021

Hello @Wynona
We know there is a Known issue on this at MS with this build ( still).
Also, this glitch is not any danger. Just an annoyance perhaps.
My very initial guess had been that the glitch may be related to Mapsreporting. But that is not so.
My 'suspicion' is that perhaps it may relate to having Fast startup enabled.
Let's just do an inquiry.
The Win +X shortcut keys should be usable in this Windows build. Press & hold Windows-key on keyboard and tap X key.
Select Command prompt Admin.
Onto the command-window Copy >> Paste this

Code:

reg export "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Power"

when done, then use the mouse pointer and do a RIGHT-Click on the top title bar of command window.

.
Select "Select all"

Next then Select COPY

Next, on this forum topic, in a new Reply, Right click the white reply box and paste.
Close the command window.

Wynona · Jul 23, 2021

maurice naggar said:
Hello @Wynona
We know there is a Known issue on this at MS with this build ( still).
Also, this glitch is not any danger. Just an annoyance perhaps.
My very initial guess had been that the glitch may be related to Mapsreporting. But that is not so.
My 'suspicion' is that perhaps it may relate to having Fast startup enabled.
Let's just do an inquiry.
The Win +X shortcut keys should be usable in this Windows build. Press & hold Windows-key on keyboard and tap X key.
Select Command prompt Admin.
Onto the command-window Copy >> Paste this

Code:

reg export "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Power"

when done, then use the mouse pointer and do a RIGHT-Click on the top title bar of command window.

.
Select "Select all"

Next then Select COPY

Next, on this forum topic, in a new Reply, Right click the white reply box and paste.
Control Panel doesn't show up, nor does Power Shell, so I took the long way around and got this. Can you open this and look at it?

Wynona · Jul 23, 2021

Well, that didn't go so well. I don't know what happened to the reply part.

In version 22000.100, I couldn't find Control Panel, nor is Power Shell present. The only thing I found was Windows Terminal. So, I took the long way around and came up with the attachment above.

BTW, the yellow triangle is still present after bootup this morning.

Fabler2 · Jul 23, 2021

Hi @Wynona . The old tools are found under 'Windows Tools' that you'll find in the start list.

Wynona · Jul 23, 2021

Fabler2 said:
Hi @Wynona . The old tools are found under 'Windows Tools' that you'll find in the start list.

View attachment 3917

View attachment 3918

Thanks, Fabler!

Ghot · Jul 23, 2021

Wynona said:
Thanks, Fabler!

Control Panel: C:\Windows\System32\control.exe

Power Shell: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

I just made shortcuts to the desktop, then you can pin them to Start or Taskbar.
In the case of Power Shell, I right clicked the desktop icon and chose: "Run as Administrator" before I pinned it.

Fabler2 · Jul 23, 2021

Ghot said:
Control Panel: C:\Windows\System32\control.exe

Power Shell: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

I just made shortcuts to the desktop, then you can pin them to Start or Taskbar.
In the case of Power Shell, I right clicked the desktop icon and chose: "Run as Administrator" before I pinned it.

I just pin Windows Tools to the taskbar so I get everything under 'one roof' so to speak.

maurice naggar · Jul 23, 2021

@Wynona Thanks for the export. Indeed, your installation is using Fast startup. Lets make an adjustment & turn that Off.
We will need to use a Elevated Powershell window. So remember the tip just above about "Windows tools".
Start elevated Powershell. Take extra care as this line is extra long. COPY ALL of the line.
Copy > Paste this entire line as-is

Code:

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Power" -Name "HiberbootEnabled" -Type DWord -Value 0

Tap Enter to apply.
Take a good look to see that that succeeded.
Close the powershell.
Be sure to do a Windows Shutdown. wait for like 30 seconds. Restart Windows.
H T H

Ghot · Jul 23, 2021

Fabler2 said:
I just pin Windows Tools to the taskbar so I get everything under 'one roof' so to speak.

I thought about that. I just figured MS would move things around again.
So I just go right for the actual file, these days.

PerpetualCycle · Jul 23, 2021

BunnyJ said:
I just had to do a restart and defender stayed on.. I did a clean instillation and that could be one of the reasons why it's staying on.

I did a windows cumulative update to .100 and it is now working after reboots.

Wynona · Jul 23, 2021

maurice naggar said:
@Wynona Thanks for the export. Indeed, your installation is using Fast startup. Lets make an adjustment & turn that Off.
We will need to use a Elevated Powershell window. So remember the tip just above about "Windows tools".
Start elevated Powershell. Take extra care as this line is extra long. COPY ALL of the line.
Copy > Paste this entire line as-is

Code:

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Power" -Name "HiberbootEnabled" -Type DWord -Value 0

Tap Enter to apply.
Take a good look to see that that succeeded.
Close the powershell.
Be sure to do a Windows Shutdown. wait for like 30 seconds. Restart Windows.
H T H

Guess that's not it in my case, Maurice. I've shut down and restarted three times, once even going into the Windows 10 partition of this dual boot system to see if things are OK over there. They are.

However, Fast Startup is off in Windows 11 and I still have the yellow triangle on every boot. I think I'll just wait for Microsoft to fix the issue; I'm tired of messing with it and have more pressing things to do.