Blog / Windows Hardening & Policy
Plug in a monitor, get adware: what the LG/McAfee mess teaches about trusting installs
Here's a sentence we didn't expect to write: plugging a new monitor into a Windows PC can get you pop-up ads. In July 2026, multiple outlets confirmed reports that connecting certain LG monitors causes Windows to silently download and install an "LG Monitor App Installer" from the Microsoft Store — no prompt, no notification — which then requests broad system access, runs at startup, and serves McAfee subscription ads after boot. Similar auto-install behavior has been reported with Alienware displays. LG's own changelog now lists McAfee as an "additional app" its installer delivers.
To be clear: this isn't a virus, and it isn't a hack. It's worse in a way — it's a built-in Windows convenience feature being used as an adware delivery truck.
How a monitor "installs software"
When you connect hardware, Windows reads the device's metadata and checks whether the manufacturer has registered a companion app for it in the Microsoft Store. If so, Device Setup Manager downloads and installs it automatically. The feature was designed to fetch drivers and utilities so things "just work." But the manufacturer decides what that companion app is and what rides along with it — and the user is never asked. The app arrives legitimately signed, straight from Microsoft's store, with "all system resources" access and an internet connection. One antivirus vendor has even flagged the LG installer as potentially unwanted; at minimum, it's software nobody chose, showing ads nobody wanted, on a channel almost nobody knows exists.
The fix for businesses: turn the channel off with Group Policy
On managed workstations and servers, one Group Policy setting closes this entirely:
Computer Configuration → Administrative Templates → System → Device Installation → "Prevent automatic download of applications associated with device metadata" → Enabled
With that enabled, Windows still installs the drivers your hardware needs —
monitors, printers, and docks keep working normally. What stops is the silent delivery
of manufacturer companion apps and whatever they bundle. Deployed once at the domain or
Intune level, it covers every machine in the fleet, current and future. (For a single
unmanaged PC, the same switch lives in Control Panel → System → Advanced system
settings → Hardware → Device Installation Settings, or via the
PreventDeviceMetadataFromNetwork registry value — but if you're managing
more than a handful of machines, policy is the right tool.)
This is a standard part of how we harden client fleets on our managed IT plans — the boring, invisible policy work that means our clients read stories like this instead of starring in them.
The bigger lesson: "it installed itself" should never be normal
This episode is a perfect small example of a principle we push constantly: don't blindly trust installs — any installs, from anyone. Not because every vendor is malicious, but because every installation is someone else's code running on your machines, and "reputable brand" clearly doesn't guarantee "asked your permission." A monitor manufacturer just used a trusted Microsoft channel to put ad-serving software on business PCs. If that channel can deliver adware, it deserves the same scrutiny as an email attachment.
That's why a well-run business environment treats software as allowed in deliberately, not wandered in:
- Users don't run as admins, so casual installs can't happen silently or at all.
- Auto-delivery channels are policy-controlled — like the device-metadata setting above, Store access, and browser extension policies.
- Software has an approved list, and anything outside it gets a quick review before it lands on a work machine.
- Something watches behavior anyway — because as we covered with ClickFix malware and modern phishing, the stuff that gets past prevention is caught by EDR watching what programs actually do.
Unwanted software is rarely one big catastrophe. It's accumulation: an ad app here, a browser toolbar there, a "helpful" vendor utility phoning home — each one more startup lag, more attack surface, more noise. A managed fleet stays clean because nothing gets on it without a decision.
What to do
If you manage your own environment: deploy the GPO above, and audit what Device Setup Manager has already installed (the LG app can be removed like any Store app). If you'd rather never think about any of this — policy hardening, software allow-listing, and the monitoring behind it are all included in our managed IT plans. Talk to us and we'll make "it installed itself" a phrase you stop hearing.