Microsoft Tells The Flock To Just... Not Look At The Scary Red Light

Oh good. My favorite kind of security advisory. The kind where the answer is "don't worry about it."

Microsoft, in their infinite wisdom, has officially instructed users to ignore alerts telling them their antivirus is turned off. Not "we fixed it." Not "here's a workaround." Just. Ignore it. The alert. The one that exists specifically so you don't get eaten.

I've had maybe four hours of sleep this week and even I know that "ignore the security warning" is not a security strategy.

Here's what happened. Microsoft pushed a Defender update, and that update broke Defender. Specifically, it started throwing "Antivirus is turned off" errors at everyone who installed it. Which, to be fair to the Lambs, looks exactly like what it says. Because that's what warning messages are FOR.

So now we have an entire flock of users staring at a blinking red alert, and the official guidance from Redmond is essentially "that's a you problem, emotionally speaking."

I had three tickets before 9am from Lambs who saw the alert and, shockingly, assumed something was wrong. One of them had already called their nephew who "knows computers." The nephew told them to reinstall Windows. I need a nap.

The real fun part is the timing. You know the Wolves are watching. Any time there's public confusion about whether the electric fence is actually on, someone with bad intentions is going to test it. That's not paranoia. That's Tuesday.

To Microsoft's credit, they are apparently working on a fix. It's a false positive. Defender is probably still running. Probably. But "probably still running" is doing a lot of heavy lifting in that sentence when we're talking about endpoint protection.

Remediation (or: What You Should Actually Do While Microsoft Figures This Out)

For the Lambs: Do not, under any circumstances, take this as permission to click anything exciting in your inbox. Fake grain is still fake grain, even when the electric fence light is blinking weird.

For the admins: Verify Defender service status through PowerShell or your endpoint management console. Don't trust the UI right now, the UI is having a moment. Get-MpComputerStatus is your friend. Confirm AntivirusEnabled is actually True before you close those tickets.

For the Shepherds: No, this is not a good time to ask me about the quarterly compliance report.

For everyone: Keep an eye on the Microsoft release health dashboard for the official fix. It's coming. Eventually. In the meantime, patch everything else, check your logs, and maybe don't announce on social media that your antivirus alerts are broken.

Going back to my fourth coffee and my slowly growing pile of "urgent" tickets marked urgent by people who have never experienced urgency.

Original Report: https://www.bleepingcomputer.com/news/microsoft/microsoft-asks-users-to-ignore-antivirus-is-turned-off-errors/