This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(124.80000000000001, 33%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETS%3C/text%3E%3C/svg%3E)
One of our users fell for a ClickFix attack and was automatically set to "CONTAINED" by Defender.
We remediated the incident by wiping the client notebook on which the attack happened, verifying that no other systems were affected, and resetting the user's password. But the "CONTAINED" status persists, blocking all network access by the user and triggering a false positive "Lateral movement" alert in Defender for each attempt.
In Defender's Action center, the last action is "Release user containment" with "Decision: Approved" and "Status: Completed". That was 17 hours ago. We tried "Enable user" multiple times as recommended by Copilot, but to no avail.
What can I do to convince Defender that the user is now safe?
A security solution that detects identity-based threats and suspicious activities in on-premises Active Directory environments
I have now opened a support request for the issue.
I have now opened a service request for the issue.
The "CONTAINED" flag did vanish, apparently by its own, half a day later. When Microsoft support finally got around to answering my request four days later there was nothing left to see. So the issue is resolved but the cause remains a mystery.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(108.80000000000001, 26%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDM%3C/text%3E%3C/svg%3E)
Glad it cleared, but worth flagging for next time: Contain user (Defender for Endpoint) and Disable/Enable user (Defender for Identity) are two separate controls. Contain user blocks network logon, RDP, SMB, and RPC at the endpoint layer. It doesn't touch the AD/Entra account state, so Enable user (which only reverses Disable user) wouldn't have released it. You'd need Undo on the Contain user action itself. It also auto-releases after 5 days regardless.
Docs: Contain a user from the network, Defender for Identity remediation actions
Thanks for the comment. Goes to show you shouldn't trust Microsoft Copilot. It was Copilot's recommendation that "Enable user" might clear the "Contain" condition. It surprised me, too, but I thought: "Well, if Microsoft's own AI says so, maybe there is something to it."