Windows Defender is warning users about a problem that isn’t real

Microsoft Defender is falsely warning some Windows users that its antivirus protection has been turned off, even when the service is active and its settings show no problem. The notifications result from a bug in a recent Defender Antivirus update, not from a loss of protection on the affected PCs.

The false alerts can appear when Windows starts and return intermittently. They also continue to appear for some users after notification settings have been disabled, making the messages seem more serious than they are.

Microsoft has acknowledged the issue in a Windows Health update and says it is preparing a fix for a future Microsoft Defender Antivirus update. The company has not provided a release date.

“Microsoft Defender Antivirus is turned off”

Affected Windows versions

The problem affects more than Windows 11. Microsoft lists supported Windows 10 releases, current Windows 11 releases and multiple Windows Server versions among the affected systems.

Recommended reading

FTC scrutiny puts AI agents' permissions under the microscope

Sergey Kuznetsov • Oct 15, 2026 • 9 min read

The issue isn’t confined to a single consumer build or Windows 11 release. Server installations are included, so administrators should compare a warning on a managed machine with Defender’s actual status rather than treat it as proof that antivirus protection has stopped.

What users should do while waiting for the fix

The warning alone does not show that Defender is disabled. Users should verify the protection state in the Windows Security app and check whether Defender’s settings show that real-time protection and the other security controls are active. If those controls are enabled, the notification is consistent with Microsoft’s known software defect.

Users shouldn’t ignore every security warning because of this bug. A genuinely disabled Defender service, a changed security setting or a separate malware alert would be a different problem. Users should distinguish the notification from the underlying state reported by Windows Security.

Microsoft says the resolution will come in a future Defender update, but the company has not said when it will ship. Until then, repeated alerts may continue even after users try to suppress them through Windows notification controls.

Update, 18 September 2026 — Fixed in Defender version 4.18.26080.4

BleepingComputer reports that Microsoft has resolved the false “Microsoft Defender Antivirus is turned off” notifications in Microsoft Defender Antivirus version 4.18.26080.4, released September 17.

The fix replaces the earlier plan for an update at an unspecified future date. Microsoft said the defect could affect all supported Windows client and server versions and could show the alert even while antivirus protection and its settings remained active.