You install the latest Windows 11 updates.
Everything seems fine.
Then you notice it.
Your mouse cursor looks different. Bigger. White. Or maybe it's completely gone.
You open Windows Security — and see a warning:
"Microsoft Defender Antivirus is turned off."
But you didn't turn it off.
You might think:
"Did something go wrong? Is my PC infected?"
Probably not.
On August 27, 2026, Microsoft released an optional preview update (KB5120998) for Windows 11 versions 24H2 and 25H2 (OS Builds 26100.9278 and 26200.9278)[reference:0][reference:1]. While it introduced new features like a movable taskbar and customizable Start menu, it also brought a significant bug affecting mouse settings.
Separately, Microsoft is also investigating false Defender warnings that have been reported across multiple Windows versions.
This guide walks you through exactly how to fix both issues — step by step.
Fix 1: Restore Your Mouse Cursor Settings
After installing KB5120998, many users report that their custom mouse cursor settings have been reset to default[reference:2][reference:3].
Common symptoms include:
- High-DPI cursors being replaced with larger white cursors that resemble Windows 98[reference:4][reference:5]
- Custom cursor schemes reverting to the system default[reference:6]
- The cursor becoming permanently enlarged and locked[reference:7]
- Desktop wallpaper being removed and reverted to a solid black background[reference:8]
- Custom cursor animations no longer working[reference:9]
Microsoft has confirmed it is investigating these mouse personalization issues[reference:10].
How to fix it:
Method 1: Reapply your cursor settings manually
- Open Settings → Bluetooth & devices → Mouse
- Click Additional mouse settings (on the right)
- Go to the Pointers tab
- Select your preferred cursor scheme from the dropdown
- Click Apply → OK
Note: Some users report that reapplying settings doesn't stick — the issue returns after logout or restart[reference:11]. If this happens, try Method 2.
Method 2: Uninstall KB5120998 (most reliable fix)
If reapplying settings doesn't work, uninstalling the update is the most reliable fix for now[reference:12][reference:13].
- Open Settings → Windows Update → Update history
- Click Uninstall updates
- Find KB5120998[reference:14]
- Click Uninstall
- Restart your PC
Users report that removing the update restores normal cursor behavior[reference:15][reference:16].
Method 3: Skip the update for now
If you haven't installed KB5120998 yet, consider skipping it[reference:17]. A permanent fix is expected at the regular Patch Tuesday on September 8, 2026[reference:18].
Fix 2: Stop the False Defender Notifications
Separately, Microsoft is investigating false Defender warnings[reference:19].
Users have reported receiving pop-up warnings claiming that "Microsoft Defender Antivirus is turned off" even when Defender is actually active[reference:20].
Microsoft has confirmed that this issue affects multiple Windows versions — including Windows 10, Windows 11, and Windows Server[reference:21][reference:22]. It does not appear to be caused by the KB5120998 update specifically[reference:23], but rather by a separate Microsoft Defender update[reference:24].
How to verify Defender is actually running:
- Open Windows Security (search "Windows Security" in Start)
- Go to Virus & threat protection
- Check if Real-time protection is On
If Real-time protection is On, Microsoft Defender's real-time protection is enabled.
How to stop the false notifications:
Method 1: Dismiss the notification
- Click the notification when it appears
- Select Dismiss or Ignore
Method 2: Restart your PC
Some users report that a simple restart clears the false notification.
Method 3: Update Defender definitions
- Open Windows Security
- Go to Virus & threat protection
- Click Check for updates (under Virus & threat protection updates)
- Install the latest definitions
- Restart your PC
Method 4: Wait for Microsoft's fix
Microsoft is working on a fix for this issue[reference:25]. A future update should resolve it permanently.
What NOT to do:
- Don't assume your PC is unprotected without checking Real-time protection first
- Don't install third-party antivirus just because of a false alarm
- Don't panic — in most cases, it's a display bug, not a real threat
How to Prevent Future Update Issues
1. Delay optional updates
Optional updates like KB5120998 are not critical. Wait a few days before installing them to see if issues are reported.
2. Create a restore point
Before installing any update, create a system restore point (search "Create a restore point" in Start). If something goes wrong, you can roll back.
3. Check Microsoft's Release Health dashboard
Microsoft tracks known issues for each update. Check before installing.
4. Monitor your system for changes
If you want to know when something changes on your PC — like new processes starting or startup entries being added — consider using a monitoring tool.
How SysPulse Can Help
If you're tired of discovering problems after they've already affected your system, you need a way to monitor what's happening on your PC — before it becomes a bigger issue.
SysPulse is a lightweight Windows monitor that watches for important system changes and alerts you in real-time.
SysPulse can:
- Detect new processes and show their full file paths
- Monitor CPU and RAM anomalies
- Detect USB connections in real-time
- Detect startup changes
- Send Telegram alerts for monitored events
- Use less than 30MB of RAM
You can set it up and let it monitor your PC in the background — so you know when something changes, even if you're not at your desk.
You can find it at: syspulse.pro
Summary Table
| Issue | Cause | Fix |
|---|---|---|
| Mouse cursor reset | Mouse personalization issue reported after KB5120998[reference:26] | Reapply settings manually or uninstall KB5120998[reference:27] |
| False Defender notification | Separate Microsoft Defender update bug[reference:28][reference:29] | Verify Defender is On, dismiss notification, wait for fix |
| Both issues | Optional August 2026 preview update + Defender update | Wait for Microsoft's official fixes[reference:30] |
Final Thought
The August 2026 Windows 11 update (KB5120998) introduced a mouse cursor bug, and a separate Defender update caused false security warnings.
If you're affected:
- Reapply your mouse cursor settings manually
- If that doesn't work, uninstall KB5120998
- Verify Defender is actually running (check Real-time protection)
- Dismiss the false notification
- Wait for Microsoft's official fixes
The key: Don't panic. Both issues are being investigated by Microsoft. And if you want to stay informed about system changes, consider a monitoring tool that alerts you in real-time.
Have questions about fixing these issues? Drop a comment below — I read every one.
Stay secure!
Top comments (0)