Microsoft says the KB5007651 Microsoft Defender Antivirus replace triggers Home windows Safety warnings on Home windows 11 programs saying that Native Safety Authority (LSA) Safety is off.

LSA Safety is a safety characteristic that defends delicate data like credentials from theft by blocking untrusted LSA code injection and course of reminiscence dumping.

Widespread person studies say that “Native Safety Authority safety is off. Your machine could also be susceptible.” warnings have been displaying up even when LSA Safety is enabled, as BleepingComputer reported on Monday.

At the moment, Microsoft acknowledged this as a brand new recognized difficulty inflicting affected Home windows units to persistently warn that they are susceptible and {that a} restart is required after toggling on LSA Safety.

Redmond says that the persistent restart alerts will solely present up on programs working Home windows 11 21H2 and 22H2.

“After putting in ‘Replace for Microsoft Defender Antivirus antimalware platform – KB5007651 (Model 1.0.2302.21002),’ you may obtain a safety notification or warning stating that ‘Native Safety safety is off. Your machine could also be susceptible.’ and as soon as protections are enabled, your Home windows machine may persistently immediate {that a} restart is required,” Redmond explains.

“This difficulty impacts solely ‘Replace for Microsoft Defender Antivirus antimalware platform – KB5007651 (Model 1.0.2302.21002).’ All different Home windows updates launched on March 14, 2023 for affected platforms (KB5023706 and KB5023698), don’t trigger this difficulty.”

​Workaround out there

Microsoft says it is engaged on a repair for the persistent LSA Safety warning points and can present extra data as quickly as out there.

The corporate additionally supplies a workaround for affected clients till a decision is accessible, asking them to disregard the restart notifications.

“In case you have enabled Native Safety Authority (LSA) safety and have restarted your machine not less than as soon as, you’ll be able to dismiss warning notifications and ignore any extra notifications prompting for a restart,” the corporate says.

To examine if LSA had truly began in protected mode in your laptop when Home windows began, you’ll be able to seek for the next WinInit occasion within the System logs beneath Home windows Logs: “12: LSASS.exe was began as a protected course of with stage: 4”

Whereas BleepingComputer reported that the warnings might be dismissed by including two registry entries, Microsoft says it does “not suggest some other workaround for this difficulty.”

Redmond additionally introduced earlier this month that it will allow Native Safety Authority (LSA) Safety by default for Home windows 11 Insiders within the Canary channel if their programs cross an incompatibility audit examine (Microsoft is but to clarify the compatibility points it is checking for).