Web Protection in Defender on Android v17 (Samsung S25) keeps switching off
I have read through the support page (https://support.microsoft.com/en-us/defender/web-protection-keeps-turning-off-on-my-android-device#bkmk_device-specific) However the page only covers Samsung with Android v13 and the solution does NOT work on my Samsung S25 with Android v17 (and One UI v9.0) Another issue is that in “Never Sleeping apps” only 19 Apps are shown that can be added and Microsoft Defender is not listed and therefore cannot be added to the “Never sleeping app“ list. Manage app if unused is OFF and greyed out so cannot be changed. Adaptive Battery is OFF Power Saving is OFF Android Version 17 One UI Version: 9.0 Android security patch level: 5 October 2026 Microsoft Defender Version 1.0.9428.0102Ошибка 0x11C7: Smart App Control блокирует Steam-приложение (satomi-chat.exe)
Описание проблемы: Здравствуйте. Функция «Интеллектуальное управление приложениями» (Smart App Control) ошибочно блокирует запуск лицензионного приложения из Steam. При попытке запуска файла satomi-chat.exe (приложение SatomiChat) система выдает уведомление «Это приложение частично заблокировано» и ошибку 0x11C7. Разработчики приложения подтвердили наличие этой проблемы на стороне защиты Windows. Дополнительные детали (баг интерфейса): В настройках Smart App Control пункт «Оценка» (Evaluation) неактивен (заблокирован). Пользователь не может перевести систему в режим оценки для запуска безопасного файла без полного отключения функции (что требует переустановки Windows). Просьба: Добавить satomi-chat.exe в белый список доверенных приложений. Исправить баг с неактивной кнопкой «Оценка» в интерфейсе Windows 11.
Microsoft Defender Offline scan: BitLocker recovery prompt and missing scan results on Windows11 Pro
Microsoft Defender Offline scan not completing or recording results — Windows 11 Pro I need help fixing Microsoft Defender Offline and verifying that scans complete successfully. History: Initially, starting an Offline scan rebooted Windows, but no scan screen appeared. The process lasted less than a minute on a laptop with 1 TB of storage. No result appeared in Protection history. SFC and DISM reported no system corruption. Windows repair failed with error 0xC1900101–0x20017; factory reset also failed. During clean installation, a technician changed or repaired something in the BIOS to resolve a storage-partition recognition problem. Windows then installed successfully. BitLocker is enabled on C: and D:. WinRE has since been repaired and enabled. Current behaviour: Defender Offline requests the BitLocker recovery key for C: after reboot. After I enter it, the Defender Antivirus scan screen appears and displays progress. The background also displays “Preparing for recovery.” (?!?!, I ran a scan, not a recovery) Windows starts normally afterward, but no new Offline scan result appears in Protection history. Event Viewer findings (31 October, around 1:52 pm): Event 1000 shows a Quick Scan started by scheduled maintenance. Event 1002 shows the same scan stopped before completion, with reason “RPC connection rundown.” I did not schedule or run a Quick Scan; I initiated only Defender Offline at that time. Other events around the same time include 1150, 1151, 1152, and 5007. Theee is also an event 2030 at 12:51pm, when I ran the offline scan for the first time today. Questions: Why do the events report a scheduled Quick Scan when I initiated Defender Offline? How can I fix this and verify that Offline scans complete successfully? Could BitLocker, WinRE, TPM, Secure Boot, or the previous BIOS repair be involved? I want to resolve this without reinstalling Windows if possible. Microsoft Support case: 7110599710.
Trojan;Win32 Threat Found- how to get rid of
I've noticed that I've been getting this same threat consistently since yesterday and even when I "remove" the threat, it just comes back. Can someone tell me what this means and what it might be from so I can remove he problem. I already did a full scan and it didn't find any other threats
Microsoft confirmed my account was hacked, but says it cannot be recovered
I am looking for guidance from the Microsoft Community or anyone who has experienced a similar account-takeover situation. Microsoft Support investigated my case and confirmed that there was unauthorized access to my Microsoft account. During the takeover, the third party changed the account's security information and enabled 2FA. Microsoft has now told me that because the security information was changed, Customer Support is unable to recover the account. The account has instead been permanently suspended. What I find difficult to understand is that the very security changes made during the confirmed unauthorized takeover now appear to prevent the legitimate account owner from recovering the account. I have already provided evidence supporting my ownership, including: Original Minecraft purchase information/invoice Billing information associated with the purchase My original account details Confirmation that the email address subsequently added to the account does not belong to me Microsoft Support's own investigation confirming unauthorized access I am not asking Microsoft to bypass account-security procedures. I am asking whether there is an escalation or verification process specifically for cases where Microsoft has already determined that an account was compromised. My questions to the community/Microsoft moderators are: Is there a senior Microsoft Account Security, Fraud, or Account Takeover team to which a confirmed-compromise case can be escalated? Can historical account information, previous security information, billing records, purchase history, device/account history, or original game entitlements be used to establish ownership? If the account itself genuinely cannot be restored, is there any process to restore or transfer a legitimately purchased Minecraft entitlement to a new Microsoft account after ownership has been independently verified? Is there any formal review or appeal mechanism available after Support has classified an account as unrecoverable? Has anyone successfully resolved a similar situation where an attacker changed the security information/2FA before the legitimate owner could regain control? I fully appreciate the need for strict account-security controls. However, I would like to exhaust the legitimate escalation and ownership-verification options before accepting that both the account and a legitimately purchased product are permanently lost because of security changes made by an unauthorized third party. Any guidance from Microsoft moderators or community members on the correct escalation channel would be greatly appreciated. Thank you.Microsoft Certified: Cloud and AI Security Engineer Associate
Im currently doing my Intern as an Information Security Intern ,I dont have any previous experience ,Can I do And complete Microsoft Certified: Cloud and AI Security Engineer Associate Certification ,Please let me know? I want to work as a Cybersecurity engineer
Microsoft defender is not catching threats before they are put into download folder.
Before I post this, please note that I’m a security researcher trained to investigate malware and other application bugs. my complaint is the following and it's a serious one that should be fixed by Microsoft as soon as possible. When I downloaded several malicious EXE files, Microsoft Defender didn't block or quarantine them during the download. Instead, Defender only detected them after I actually ran or executed the files. I also noticed that online platforms showed Microsoft Defender detecting the threats, so the files were clearly being recognized as malicious by Defender's engine. Has Microsoft changed the way Defender detects malware? Does it now require a malicious file to be executed before it detects it, similar to how some behavioral detection works in Malwarebytes? Or should Defender still be detecting and blocking known malicious EXE files before they are executed/downloaded because it's not at this current time and this is a clean installed system. My system is clean, and I even performed a clean installation of Windows. I also used ConfigureDefender with the settings configured to High, and all of the relevant protection settings appeared to be enabled.I'm trying to understand whether this is normal behavior with the current version of Microsoft Defender or if something might be misconfigured on my system. Before, Microsoft Defender would detect and block malicious files while they were being downloaded, before I had a chance to run or execute them. Now, however, it seems like Defender is allowing the files to finish downloading and only detects them after I execute them. Windows Defender isn't detecting EICAR test files? Mine doesn’t seem to detect them automatically, as shown in my proof. It only detects the file when I right-click it and select “Scan with Microsoft Defender.” Is this normal? It seems pretty crazy that it doesn’t detect the file immediately. it allowed them all to download. It's not even blocking Eicar test files when i bypass edges warning to download it just allows it to download no problem. edge detects it but Microsoft security does not. Please have Microsoft’s threat team investigate why Windows Defender isn’t detecting malicious files when downloaded through Microsoft Edge. When Edge warns about a malicious or suspicious download and those warnings are bypassed, the files aren’t caught or blocked by Defender and end up being saved to the system. This is extremely dangerous and needs to be replicated to confirm the issue.Microsoft Defender
Goodmorning: I am working with a laptop Acer Aspire 3 15 , Windows 11. Microsoft Defender worked fine until two days ago. Then it started being blocked at 91 percent instead of compliting the program at 100 percent. Please, if a person can help me in understanding what causes this problem I will be very grateful. Thanks FFBX
Issues blocking DeepSeek
Hi all, I am investigating DeepSeek usage in our Microsoft security environment and have found inconsistent behaviour between Defender for Cloud Apps, Defender for Endpoint, and IOC controls. I am hoping to understand if others have seen the same. Environment Full Microsoft security and management suite What we are seeing Defender for Cloud Apps DeepSeek is classified as an Unsanctioned app Cloud Discovery shows ongoing traffic and active usage Multiple successful sessions and data activity visible Defender for Endpoint Indicators DeepSeek domains and URIs have been added as Indicators with Block action Indicators show as successfully applied Advanced Hunting and Device Timeline Multiple executable processes are initiating connections to DeepSeek domains Examples include Edge, Chrome, and other executables making outbound HTTPS connections Connection status is a mix of Successful and Unsuccessful No block events recorded Settings Network Protection enabled in block mode Web Content Filtering enabled SmartScreen enabled File Hash Computation enabled Network Protection Reputation mode set to 1 Has anyone else had similar issues when trying to block DeepSeek or other apps via Microsoft security suite? I am currently working with Microsoft support on this but wanted to ask here as well.Can’t Remove Defender Tag After Asset Rule Was Deleted
Hi all, I’m facing an issue where a rule-based tag in Microsoft Defender for Endpoint remains visible on devices even after I deleted the original asset rule. The rule was disabled and deleted months ago, but the tag still appears under Rule-based tags in the device details. Even using the API or PowerShell doesn’t show or remove it. Is there any supported way to force a tag refresh or clear orphaned rule-based tags from the Defender portal? Thanks in advance, Luca
