Microsoft has successfully addressed a persistent issue that led to misleading alerts indicating that Defender Antivirus was disabled following recent updates. This resolution was confirmed in an update to the Windows release health dashboard on Thursday, detailing the fix implemented in the Microsoft Defender Antivirus update (version 4.18.26080.4), which was rolled out on September 17.
The company initially acknowledged this bug in late August, noting its impact on users within the Release Preview Channel of the Windows Insider program since at least June. The problem affected all supported versions of Windows clients and servers, including the latest iterations of Windows 11 26H1 and Windows Server 2025. Users encountered erroneous notifications in the Windows Security app, prompting them to “Tap or click to turn on Microsoft Defender Antivirus,” despite the antivirus functioning correctly.
As Microsoft elaborated, “After installing the latest updates for Microsoft Defender Antivirus, notifications might appear stating that ‘Microsoft Defender Antivirus is turned off,’ even though the antivirus is functioning correctly and all settings show it as active.” These misleading alerts could emerge upon Windows startup and intermittently thereafter, persisting even when users disabled notification settings.
Historical Context of Similar Issues
This incident is not an isolated one; Microsoft has previously requested users to disregard erroneous alerts following updates. In April 2025, the company tackled a problem that triggered incorrect BitLocker drive encryption errors on both Windows 10 and Windows 11 devices. Additionally, it rectified a bug that caused invalid 0x80070643 failure errors after the installation of Windows Recovery Environment (WinRE) updates.
In July 2025, users were advised to overlook erroneous Windows Firewall alerts that surfaced after rebooting post the June 2025 preview update. A month later, Microsoft issued a warning regarding the July 2025 preview update and subsequent Windows 11 24H2 updates, which were responsible for incorrect CertificateServicesClient (CertEnroll) errors.
In a related development, Microsoft also released emergency updates this week to rectify issues with Remote Desktop Services, Hyper-V, and USB audio, which were caused by the September 2026 security updates.
