The Windows Local Security Authority Subsystem Service, aka LSASS, handles security policy enforcement for that OS. With KB5023706 (installed on 3/14) on my mainstream Windows 11 PC, some have shown interesting side-effects. My P16 manifests LSASS bug shown in the lead-in graphic.

Basically, it falsely asserts that LSASS protection is turned off (see text in red box). How do I know it’s actually running? As I searched the System log in Event Viewer, I found a message indicating the “LSASS.exe (process) was started…” as part of that system’s last boot-up. According to this discussion of that very issue at BleepingComputer.com, this indicates that LSASS protection is enabled and working as it should be.

The Event Viewer (System Log) reports a successful start of LSASS.exe as part of the OS boot-up process. It’s working!

What To Do If Your P16 Manifests LSASS Bug

Of course, this applies to all Windows PCs of all kinds. That said, the afore-linked BleepingComputer story explains a couple of Registry hacks that will fix such spurious notifications. MS will probably get around to fixing this sooner or later. Meanwhile, I’m not concerned about false security flags. Indeed, I’m content to wait until it’s corrected in some future update.

It sounds like a serious error. And it would be a major security hole, if the notification were true. But since it’s simply a false positive, and I’ve proved to myself that things are working as they should be, I’ll live with it.

This problem has been in play for some while now (BleepingComputer reports it goes back to January 2023). If I search for “Local security authority protection is off” at ElevenForum.com, I see hits as far back as March 1, 2023, on this topic. All are unanimous in flagging this as a false positive not worth corrective action.

But that’s the way things sometimes go here in Windows-World. Take it under advisement if you see the “Yellow bang!” in Windows Security on your Windows 11 PC. Cheers!

OK, then. Now I finally understand what’s up with the Store-based version of Windows Defender. It’s been “out there” for while now for Insiders. Called “Microsoft Defender for individuals,” it’s available to anyone with an active Microsoft 365 subscription. (Either Personal or Family subscriptions qualify.) That’s why I say “MS 365 brings new Defender aboard” in today’s title. The lead-in graphic shows the dashboard (in part) from my production Windows 10 desktop. Both “other devices” run Windows 11.

When MS 365 Brings New Defender Aboard, Then What?

According to MSPowerUser.com the tool is built on Microsoft Defender Endpoint technology. Thus, it brings the same cloud-based security to end users already available to Enterprise customers. A June 16 Microsoft Security blog post confirms this assertion. It describes this new Defender version as “an exciting step in our journey to bring security to all.” The tool works on Windows, iOS, Android, and macOS devices to provide family-wide protection across whole households.

MS explains Microsoft Defender for individuals as enabling the following capabilities (also including “continuous antivirus and anti-phishing protection for your data and devices”):

• Manage your security protections and view security protections for everyone in your family, from a single easy-to-use, centralized dashboard.
• View your existing antivirus protection (such as Norton or McAfee). Defender recognizes these protections within the dashboard.
• Extend Windows device protections to iOS, Android, and macOS devices for cross-platform malware protection on the devices you and your family use the most.
  
• Receive instant security alerts, resolution strategies, and expert tips to help keep your data and devices secure.

I’m giving it a try on my production PC which still runs Norton 360, along with a couple of my Defender-only test machines running Windows 11. Should be interesting to see how it all turns out! If you’d like to check it out for yourself and your devices (and your family’s, if applicable) visit the Microsoft 365 Defender page for a download link.

For months now, I’ve been seeing traces of a low-risk “potentially unwanted app”  (PUA) on one of my Dev Channel test PCs. You can see the Windows Security log trace entry for this item above. It’s named FusionCore.C and it shows up as low-risk adware. This morning I ran Malwarebytes’ AdwCleaner (v 8.3.1) to see if it would make it go away. It did, so I can report that AdwCleaner roots out PUAs. It’s free and doesn’t install so it inflicts no system footprint, either.

Because AdwCleaner Roots Out PUAs, Use It!

Now that Microsoft Defender has shown itself to be a great first-line of security defense for Windows PCs, I don’t recommend third-party AV or other real-time protection tools anymore. That said, cleanup tools like AdwCleaner can be helpful. That goes double, because while Defender flags FusionCore.C and other adware instances, it doesn’t offer its own clean-up capability (or even remediation advice).

When you run the AdwCleaner executable (adwcleaner_8.3.1.exe), it finds the two offending PUA elements right away. These consist of a .tmp file and and .exe file. Both have FusionCore.C in their file names. If you check those items under the PUP (Potentially Unwanted Program) heading, you can flag them for quarantine and removal. The following screencap shows the two items checked for potential quarantine.

All you need to do to flag items is to check the box to the left for each one you’d like to quarantine or remove.

Then, simply click Next to get to the quarantine Window. On this PC a bunch of pre-installed Lenovo items also appear (I don’t care about those: I actually USE most of them). I check none of those items, which are hidden behind the fore-window that says “Cancel” and “Continue.” I choose “Continue” and the items get quarantined. I run another Defender scan and sure enough, the PUAs no longer get reported. A visual inspection of the source folder (shown in the lead-in graphic) shows the items are no longer present there as well. Good-oh!

Click “Continue” and the checked PUA items go into quarantine, and off Defender’s scan radar. Done!

Hoo boy! I’ve been checking in on the Store-based version of the Microsoft Defender Preview since last November. Until this morning, I had no luck getting this cross-platform, multi-device app working. After seeing a story in WindowsUpdate minutes ago, I zipped into the MS Store to try again. And indeed, now that MS Defender Preview accepts personal MSAs (Microsoft Accounts) it appears to be working!

If MS Defender Accepts Personal MSAs, Anybody Can Use It

In the next screencap you can see the dashboard screen from the Microsoft Defender Preview. One must, however, also install this app on other devices before they show up on this dashboard. So naturally, I dashed over to my other Dev Channel test machine (via RDP, no physical movement needed) and used the URL to go straight to the app in Store: https://mysecurity.microsoft.com/downloads.

The dashboard doesn’t look like much until you start adding devices. [Click image for full-sized view.]

After a quick  update, I opened the newest version to see the initial welcome screen I missed on my first MS Defender Preview encounter. I signed up with the same MSA (so both devices would show up on a single dashboard: IDs are deliberately obscured).

To see devices on the same dashboard, you must associate them with a common MSA. [Click image for full-sized view.]

With Time and Exposure, More to Come

That’s about all I have time to deal with this morning. I’m tightly wrapped in legal business this week, so my posts will be short and less frequent than usual. This opening up of the preview, however, was big enough news that I had to share. Check it out, and have fun!

I have to chuckle. At the start of November, I wrote here that “I Get No MS Defender Preview.” Just to check up, I went back to the store to grab the Preview. It was no surprise at all that I can still report the same thing. What’s different now is the error message that comes up, as shown in the lead-in graphic. My latest sticking point represents a new MS Defender Preview impediment. As you can see, my account is now recognized, but I can’t log into the preview. Sigh.

Clueless on Overcoming New MS Defender Preview Impediment

I’ve dug around online, at both Microsoft and third-party Windows sites. I cannot find any info on how to subscribe to the Microsoft Defender Preview. Presumably, that would also provide me with necessary login info. But there’s no enlightenment obtainable on how that might be arranged.

Often, when Windows features go into limited release in the Preview channels, I find myself at the end of the pack in gaining access. That phenomenon seems likely in this case, too. I’ll raise a flag in the WIMVP forums and see if I can provoke any action. Shoot! I’d be happy just to get more information on how to subscribe and start participating in the Microsoft Defender Preview.

But — as is so often the case in my experience — I’m on the outside looking in. I know this Preview is happening. I simply can’t get access to it, to sample its functions and capabilities. Stay tuned: I’ll keep you posted as I try to work my way into that charmed space. Hopefully that will happen sooner rather than later. We’ll see!