Windows Security glitch

Topic

New Reply

[CynicalSnail]

Very new machine, very good spec., supplied with Win 11 22H2.

Oddity: open “Windows Security”: panels show – for about 5 s, then the window closes.  Repeat: window opens blank white (except for tiny title annotation top left), vanishes in 5 s.  Repeat ad infinitum.  Cannot get at any settings, it seems unless I go to Start | Settings | Settings | Privacy and Security | Windows Security (*1) (tedious!) … but then Device Security (which has a warning) opens the window (no warning!), but clicking Home causes it to close again, 5 s.   (All other options are functional.)

A bug, I suggest.

I then tried typing “Windows Security” in the Start | search bar.   That does not work either.   The first time disabled all the buttons in the panel at (*1) above!  Then  various combinations of vanishing windows, blue shield, white window … Not good.

 

• This topic was modified 2 years, 1 month ago by CynicalSnail.
• This topic was modified 2 years, 1 month ago by CynicalSnail.

Reply | Quote

Replies

Besides Windows, what else has been installed?

What brand of machine?

Local account or Microsoft account?

Susan Bradley Patch Lady/Prudent patcher

Reply | Quote

Installed: many things – trying to get back to be able to work.  No special defences.

Brand: built for me …

Corsair Carbide 275Q Casing
13^th Gen i9 Processor (24 Core Version)
MSI Z790 Pro Motherboard
CyberPower MasterLiquid 360 Liquid Cooling (CPU Water Cooling)
GeForce RTX 3070 8GB Graphics Card
64GB DDR5 /5600MHZ Ram
MSI A850 850W Gold Modular Power Supply
2 x 1TB Solidigm NVME SSD Hard Drive
Windows 11 Pro

Local account.

 

BTW: the system tray popup has the WS icon flagged as needing attention.  That also fails to get the window to work, but the other route does not indicate any problem anywhere (except as mentioned, also not identifiable).

 

Reply | Quote

I tried sfc /scannow: several errors fixed, it seems – all links!  No detectable change in behaviour.

Reply | Quote

And they didn’t run any scripts or anything to block anything/turn off stuff? IMHO anytime you have a brand new install ‘repair’ stuff with sfc /scannow I question the original install.

Susan Bradley Patch Lady/Prudent patcher

Reply | Quote

Not to my knowledge – nothing discussed.  I can check …

But, it was only “.lnk” for every item.

Reply | Quote

The answer is an emphatic no – absolutely nothing.

Reply | Quote

With my deepest respect, I would bet something – or something accidentally got downloaded that messed up Windows 11.  Did you try the PowerShell elevated command to reregister the apps?

Susan Bradley Patch Lady/Prudent patcher

Reply | Quote

When a GUI fails my first reaction is to use a command line tool deal with the problem. PowerShell comes to mind. A Google search of “powershell windows security windows 11” leads to Windows 11’s Windows Security App can’t open. Perhaps this can lead to a solution for you.

HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB
HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB

Reply | Quote

See also “How to manage Microsoft Defender Antivirus with PowerShell on Windows 10” which will probably also work on Windows 11 before you get too hung up on getting the GUI to work. The article says: “You can manage settings and control virtually any aspect of the Microsoft Defender Antivirus using PowerShell commands, and in this guide, we’ll help you get started”.

HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB
HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB

Reply | Quote

Enter:Get-MpComputerStatus : AV enabled, true.

Reply | Quote

Get-AppxPackage Microsoft.SecHealthUI -AllUsers | Reset-AppxPackage

… did not work.

Reply | Quote

Define “did not work”? Did you use an elevated PowerShell window? What results did you see?

Susan Bradley Patch Lady/Prudent patcher

Reply | Quote

Had no detectable effect.

Yes.  No message of any kind, as I recall.

Repeated the exercise with PS 7.3.3 … brief progress bar flash, but no message.  WS still does not open.

Reply | Quote

https://social.technet.microsoft.com/wiki/contents/articles/37943.how-to-reinstall-and-re-register-all-the-built-in-apps-in-windows-10-creator-update.aspx

… did not work.

Reply | Quote

Try Settings, Apps, Installed apps, Windows Security, …, Advanced options, Reset:

Reset Windows Security app in Windows 11

Reply | Quote

Thanks for that.  I tried repair first – no effect.

Reset: The window opened with a shield, then after a few seconds went blank with the “Windows Security” tiny annotation top left, then after a few more seconds the functions panel opened.

Close and retry: fail as before.

Reset.

Retry: fail.

From Settings | Windows Security | Open WS button …    first time I get the menu, the second fails as before.

Reset again … no joy.  But from the System Tray pop-up – it works.  All status remarks: unknown.  AV update button seemed not to be working, but then after a few seconds the panel reloaded and all indications were good except firewall.  But before I could do anything that window closed by itself.

Try again: opens … Standard Hardware security not supported – it was before.

Firewall settings not standard – Restore … no apparent effect, then window goes blank and closes.

Cannot now restart by that route or any other.

So, a step forward, but not a lot of progress.

 

 

1 user thanked author for this post.

b

Reply | Quote

CynicalSnail wrote:

Device Security (which has a warning) opens the window (no warning!), but clicking Home causes it to close again, 5 s. (All other options are functional.)

Update for Microsoft Defender Antivirus antimalware platform – KB5007651 (Version 1.0.2302.21002)

You might want to see if this update was installed about the same time you started having difficulties.

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

Reply | Quote

That was installed 2023-02-26, but while I certainly noticed the problem after that date I cannot remember anything before then – I might have checked things.

Has that been reported as problematic, then?  I always install these updates, and definitions, as a routine, never having seen doubts expressed.

Thanks.

Reply | Quote

A quick search
1    https://www.elevenforum.com/t/update-for-windows-security-platform-kb5007651-version-1-0-2209-22001-problems.9265/

2    (supposed solution linked in message 2)
https://answers.microsoft.com/en-us/windows/forum/windows_11-security/build-226211265-received-security-update-kb5007651/9be1583a-0d89-454b-aad7-a546c133a7ae?messageId=e9266036-0689-4f77-9c94-6599f1b80ee8

3    In there it refers to:
https://www.elevenforum.com/t/enable-or-disable-local-security-authority-lsa-protection-in-windows-11.11104/

But, I have no LSA item in W Security | Device Security, the mentioned reg entries are absent, and LGP both not configured.

Q: Is any of this relevant to the vanishing WS window?  Does it matter anyway?  It just looks like bad code, for the problem I have reported, but the update looks like it is very bad in other ways.

What to do?

 

1 user thanked author for this post.

geekdom

Reply | Quote

CynicalSnail wrote:

What to do?

After installing KB5007651, Windows Security would close immediately after open. I rebooted and tested Windows Security, and repeated reboot and test until Windows Security remained open.

I then received the Local Security Authority protection is off message you mentioned here:
https://answers.microsoft.com/en-us/windows/forum/windows_11-security/build-226211265-received-security-update-kb5007651/9be1583a-0d89-454b-aad7-a546c133a7ae?messageId=e9266036-0689-4f77-9c94-6599f1b80ee8

In https://www.elevenforum.com/t/enable-or-disable-local-security-authority-lsa-protection-in-windows-11.11104/ there were four methods to correct the problem.
I selected Step 2 Turn_ON_Local_Security_Authority_protection.reg​, downloaded it, and ran it.

There were no further difficulties and Windows Security ran as expected.

This update was installed on my computer system on March 15, 2023, and I immediately noticed problems and immediately employed the remedies described above. I hope they work for you.

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

1 user thanked author for this post.

CynicalSnail

Reply | Quote

Well, well … I did that – Option 2: registry now shows those items, although GPE still shows two LSA items as ‘not configured’ (not expected, I assume)

WS seems to open repeatedly in various ways without a glitch, although LSA does not appear in the Core Isolation panel.

Amazing how such tiny faults cause so much trouble …

Many thanks.

1 user thanked author for this post.

geekdom

Reply | Quote

This is what Core Isolation Local Security Authority protection looks like after running the ON_Local_Security_Authority_protection.reg​ correction:

 

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

Reply | Quote

H’mm … not for me:

1 user thanked author for this post.

geekdom

Reply | Quote

I also went to Local Group Policy Editor and enabled LSASS as a protected process. Option 3 in https://www.elevenforum.com/t/enable-or-disable-local-security-authority-lsa-protection-in-windows-11.11104/

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

Reply | Quote

So should I use UEFI locked or not?

Consequences either way?

Reply | Quote

In the Credential Guard Configuration box, select Enabled with UEFI lock. If you want to be able to turn off Windows Defender Credential Guard remotely, choose Enabled without lock.

Source:
https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage

Different setting, same UEFI toggle.

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

Reply | Quote

I have the Pro version, not Enterprise or Education.  I have no options under that heading in Core Isolation.

But, I have no need of remote access for management purposes, so I assume then that UEFI lock is the best option for LSASS.  Now set.

I find some of this stuff simply bewildering.

Reply | Quote

So you recently received KB5007651 – as that’s an old patch and wasn’t recently released.

Susan Bradley Patch Lady/Prudent patcher

Reply | Quote

Susan Bradley wrote:

So you recently received KB5007651 – as that’s an old patch and wasn’t recently released.

Yes, it was a Windows Update and showed in WuMgr on March 15, 2023. It is installed now and Windows Security is now operating appropriately. How old is the patch?

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

Reply | Quote

Mine was already installed on Feb 28!

1 user thanked author for this post.

geekdom

Reply | Quote

As a last note, I checked the Microsoft Update Catalog for this KB5007651 update. It does not appear in the catalog. No documentation makes it extremely difficult to track when the update was created, what functions or fixes were implemented, and what new issues were noted.

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

Reply | Quote

Does that mean it has been pulled?  Looks irresponsible to me.

See: https://researchsnipers.com/windows-11-kb5007651-bug-compromises-device-security/

– I have no other AV installed.

1 user thanked author for this post.

geekdom

Reply | Quote

CynicalSnail wrote:

Does that mean it has been pulled? Looks irresponsible to me.

Microsoft’s implementation of this update and lack of error information strikes me as irresponsible, also.

I don’t know if the update has been pulled from the catalog or from the update queue.

I have no other anti-virus software either, although I will occasionally run an online third-party anti-virus program.

I made changes to my computer system as indicated earlier — and Windows Security now runs appropriately.

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

Reply | Quote

I think it’s one of those “defender in the background” updates.

https://www.gamingdeputy.com/protection-by-local-security-authority-issues-caused-by-kb5007651-in-windows-11-22h2/

I’ll have to do more research.

Susan Bradley Patch Lady/Prudent patcher

1 user thanked author for this post.

geekdom

Reply | Quote

My PC builder, who I have kept in the loop, has just said:

“I have a case open with Microsoft regarding this and they’ve confirmed what you’ve already said: it’s totally screwed.

We have had 2 others with the same problem in 2 days, and both customers have opted to go back to Windows 10 and install 11 when it’s a lot more stable!”

Dear oh dear!  What to say?

 

 

1 user thanked author for this post.

geekdom

Reply | Quote

Susan Bradley wrote:

I think it’s one of those “defender in the background” updates.

It showed in WuMgr as a Windows Update.

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

Reply | Quote

That’s all I know, folks.

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

Reply | Quote