How do we stop scareware notifications on Windows PCs?

This sounds like a website notification permission rather than an installed program. A user can allow a site to send notifications, and the site can then make those alerts look like antivirus warnings.

In Edge, check Settings, Cookies and site permissions, then Notifications. Remove or block any suspicious allowed sites. Check the other affected profiles too, since clearing the Windows notification history won't revoke the site's permission.

For the wider rollout, set the Edge notification policy through your management tools. DefaultNotificationsSetting set to 2 blocks site notifications. If some business sites genuinely need them, look at an explicit allow list rather than letting every site ask.

Check the resulting policy and existing site permissions on a test machine before deploying broadly. Apply equivalent controls to any other managed browsers people use.

I wouldn't rely on the firewall block alone. Browser push notifications can arrive through the browser's notification service, so blocking the site's domain may not stop an existing subscription. Revoke the permission or enforce a browser policy, then verify the alerts have stopped.

Also consider profile sync when troubleshooting a recurring permission. Reimaging a machine may not be enough if the browser profile restores it.

Ask the affected users whether they clicked any of the alerts or downloaded anything afterward. The notifications themselves can be just a browser permission, but a click may have led to a scam page or a separate download. Investigate those cases rather than treating every popup as proof of infection.

Blocking site notifications is the direct fix. An ad blocker or web filtering can add another layer, and Edge also has a scareware protection option worth reviewing. Neither replaces checking what users may have clicked or controlling notification permissions.