For nearly two months, users of Windows 11 have faced an unusual predicament: persistent notifications from the Windows Security app erroneously indicating that Microsoft Defender was disabled, despite it functioning properly. This issue, which first emerged in early August, has now been addressed with a recent security update from Microsoft.
The notifications, which urged users to reactivate their antivirus protection, understandably caused concern among many. Upon investigating, users discovered that their Defender settings remained intact, and the alerts were merely a glitch. Microsoft confirmed that this false alert affected all versions of Windows 11, Windows Server, and even Windows 10.
In our tests, we observed that toggling Defender off and on had no effect on the erroneous notifications. After reaching out to Microsoft, it became clear that the root of the problem was linked to a bug introduced with a recent Defender security update. The company acknowledged the issue, stating, “After installing the latest updates for Microsoft Defender Antivirus, notifications might appear stating that ‘Microsoft Defender Antivirus is turned off,’ even though the antivirus is functioning correctly and all settings show it as active.” However, Microsoft did not specify which update triggered the problem.
Given that Defender updates are rolled out daily, pinpointing a specific update for removal is not a straightforward task. Unlike typical Windows updates, the Defender updates operate differently, complicating the resolution process for affected users.
Curiosity led me to explore these false alerts myself, checking to see if my antivirus protection had indeed been compromised. Each time, I was redirected to the Windows Security home tab, which confirmed that all protections were active and displayed the last scan time. While Windows Security also encourages users to enable OneDrive sync, that’s a separate discussion altogether.
Although users have the option to dismiss the “Turn on virus protection” alert, it proves futile, as the notification reappears relentlessly. Users cannot disable these notifications entirely, which adds to the frustration. Microsoft noted, “These notifications can appear when Windows starts and intermittently afterward. They persist even if notification settings are turned off.”
Microsoft confirms it fixed Windows Defender false errors, explains what you need to do
In an updated support document, Microsoft clarified that no manual action is required from users, as the fix will be automatically deployed to all PCs, provided that mandatory security updates have not been disabled via the Registry Editor or Group Policy. The issue was resolved in the Microsoft Defender Antivirus update (version 4.18.26080.4), released on September 17, 2026.
As confirmed, the false alerts have ceased, but for those who remain uncertain, verifying the status of Defender is a prudent step. Users can check the current status by opening Windows Security and ensuring it indicates that the antivirus is active, along with the last threat scan time. Alternatively, a security status report can be generated using PowerShell with the following command:
powershell -command "Get-MpComputerStatus | Select-Object AntivirusEnabled,RealTimeProtectionEnabled,AMServiceEnabled"
The expected output should confirm that all three features related to Windows Defender are operational:
AntivirusEnabled : True RealTimeProtectionEnabled : True AMServiceEnabled : True
While the resolution is welcome, Microsoft faces scrutiny regarding the delay in addressing these issues, which date back to early August. Furthermore, the company is currently navigating additional challenges within Windows 11, including audio issues and errors affecting AMD PCs.
