Windows 11 KB5120998 Mouse Cursor Bug: How to Fix It + False Defender Warning Explained

You install the latest Windows 11 updates.

Everything seems fine.

Then you notice it.

Your mouse cursor looks different. Bigger. White. Or maybe it's completely gone.

You open Windows Security — and see a warning:

"Microsoft Defender Antivirus is turned off."

But you didn't turn it off.

You might think:

"Did something go wrong? Is my PC infected?"

Probably not.

On August 27, 2026, Microsoft released an optional preview update (KB5120998) for Windows 11 versions 24H2 and 25H2 (OS Builds 26100.9278 and 26200.9278)[reference:0][reference:1]. While it introduced new features like a movable taskbar and customizable Start menu, it also brought a significant bug affecting mouse settings.

Separately, Microsoft is also investigating false Defender warnings that have been reported across multiple Windows versions.

This guide walks you through exactly how to fix both issues — step by step.

Fix 1: Restore Your Mouse Cursor Settings

After installing KB5120998, many users report that their custom mouse cursor settings have been reset to default[reference:2][reference:3].

Common symptoms include:

• High-DPI cursors being replaced with larger white cursors that resemble Windows 98[reference:4][reference:5]
• Custom cursor schemes reverting to the system default[reference:6]
• The cursor becoming permanently enlarged and locked[reference:7]
• Desktop wallpaper being removed and reverted to a solid black background[reference:8]
• Custom cursor animations no longer working[reference:9]

Microsoft has confirmed it is investigating these mouse personalization issues[reference:10].

How to fix it:

Method 1: Reapply your cursor settings manually

1. Open Settings → Bluetooth & devices → Mouse
2. Click Additional mouse settings (on the right)
3. Go to the Pointers tab
4. Select your preferred cursor scheme from the dropdown
5. Click Apply → OK

Note: Some users report that reapplying settings doesn't stick — the issue returns after logout or restart[reference:11]. If this happens, try Method 2.

Method 2: Uninstall KB5120998 (most reliable fix)

If reapplying settings doesn't work, uninstalling the update is the most reliable fix for now[reference:12][reference:13].

1. Open Settings → Windows Update → Update history
2. Click Uninstall updates
3. Find KB5120998[reference:14]
4. Click Uninstall
5. Restart your PC

Users report that removing the update restores normal cursor behavior[reference:15][reference:16].

Method 3: Skip the update for now

If you haven't installed KB5120998 yet, consider skipping it[reference:17]. A permanent fix is expected at the regular Patch Tuesday on September 8, 2026[reference:18].

Fix 2: Stop the False Defender Notifications

Separately, Microsoft is investigating false Defender warnings[reference:19].

Users have reported receiving pop-up warnings claiming that "Microsoft Defender Antivirus is turned off" even when Defender is actually active[reference:20].

Microsoft has confirmed that this issue affects multiple Windows versions — including Windows 10, Windows 11, and Windows Server[reference:21][reference:22]. It does not appear to be caused by the KB5120998 update specifically[reference:23], but rather by a separate Microsoft Defender update[reference:24].

How to verify Defender is actually running:

1. Open Windows Security (search "Windows Security" in Start)
2. Go to Virus & threat protection
3. Check if Real-time protection is On

If Real-time protection is On, Microsoft Defender's real-time protection is enabled.

How to stop the false notifications:

Method 1: Dismiss the notification

1. Click the notification when it appears
2. Select Dismiss or Ignore

Method 2: Restart your PC

Some users report that a simple restart clears the false notification.

Method 3: Update Defender definitions

1. Open Windows Security
2. Go to Virus & threat protection
3. Click Check for updates (under Virus & threat protection updates)
4. Install the latest definitions
5. Restart your PC

Method 4: Wait for Microsoft's fix

Microsoft is working on a fix for this issue[reference:25]. A future update should resolve it permanently.

What NOT to do:

• Don't assume your PC is unprotected without checking Real-time protection first
• Don't install third-party antivirus just because of a false alarm
• Don't panic — in most cases, it's a display bug, not a real threat

How to Prevent Future Update Issues

1. Delay optional updates

Optional updates like KB5120998 are not critical. Wait a few days before installing them to see if issues are reported.

2. Create a restore point

Before installing any update, create a system restore point (search "Create a restore point" in Start). If something goes wrong, you can roll back.

3. Check Microsoft's Release Health dashboard

Microsoft tracks known issues for each update. Check before installing.

4. Monitor your system for changes

If you want to know when something changes on your PC — like new processes starting or startup entries being added — consider using a monitoring tool.

How SysPulse Can Help

If you're tired of discovering problems after they've already affected your system, you need a way to monitor what's happening on your PC — before it becomes a bigger issue.

SysPulse is a lightweight Windows monitor that watches for important system changes and alerts you in real-time.

SysPulse can:

• Detect new processes and show their full file paths
• Monitor CPU and RAM anomalies
• Detect USB connections in real-time
• Detect startup changes
• Send Telegram alerts for monitored events
• Use less than 30MB of RAM

You can set it up and let it monitor your PC in the background — so you know when something changes, even if you're not at your desk.

You can find it at: syspulse.pro

Summary Table

Final Thought

The August 2026 Windows 11 update (KB5120998) introduced a mouse cursor bug, and a separate Defender update caused false security warnings.

If you're affected:

1. Reapply your mouse cursor settings manually
2. If that doesn't work, uninstall KB5120998
3. Verify Defender is actually running (check Real-time protection)
4. Dismiss the false notification
5. Wait for Microsoft's official fixes

The key: Don't panic. Both issues are being investigated by Microsoft. And if you want to stay informed about system changes, consider a monitoring tool that alerts you in real-time.

Have questions about fixing these issues? Drop a comment below — I read every one.

Stay secure!