• 2 min read
Windows Defender is warning users about a problem that isn’t real
A Microsoft Defender bug is falsely telling Windows 10 and 11 users their antivirus is disabled. Microsoft says a fix is coming.
Image: PCWorld
Microsoft Defender is falsely warning some Windows users that its antivirus protection has been turned off, even when the service is active and its settings show no problem. The notifications result from a bug in a recent Defender Antivirus update, not from a loss of protection on the affected PCs.
The false alerts can appear when Windows starts and return intermittently. They also continue to appear for some users after notification settings have been disabled, making the messages seem more serious than they are.
Microsoft has acknowledged the issue in a Windows Health update and says it is preparing a fix for a future Microsoft Defender Antivirus update. The company has not provided a release date.
“Microsoft Defender Antivirus is turned off”
Affected Windows versions
The problem affects more than Windows 11. Microsoft lists supported Windows 10 releases, current Windows 11 releases and multiple Windows Server versions among the affected systems.
Recommended reading
Manchester Airports breach exposes data on 8.7 million customers
Sophia Reynolds • • 5 min read
| Operating system | Versions affected |
|---|---|
| Windows 10 | 22H2, 21H2, Enterprise LTSC 2019, Enterprise LTSC 2016 |
| Windows 11 | 26H1, 25H2, 24H2, 23H2 |
| Windows Server | 2025, 2022, 2019, 2016, 2012 R2, 2012 |
The issue isn’t confined to a single consumer build or Windows 11 release. Server installations are included, so administrators should compare a warning on a managed machine with Defender’s actual status rather than treat it as proof that antivirus protection has stopped.
What users should do while waiting for the fix
The warning alone does not show that Defender is disabled. Users should verify the protection state in the Windows Security app and check whether Defender’s settings show that real-time protection and the other security controls are active. If those controls are enabled, the notification is consistent with Microsoft’s known software defect.
Users shouldn’t ignore every security warning because of this bug. A genuinely disabled Defender service, a changed security setting or a separate malware alert would be a different problem. Users should distinguish the notification from the underlying state reported by Windows Security.
Microsoft says the resolution will come in a future Defender update, but the company has not said when it will ship. Until then, repeated alerts may continue even after users try to suppress them through Windows notification controls.
Frequently asked questions
Is Microsoft Defender actually turned off?+
Not necessarily. Microsoft says the warning can appear while Defender remains active and its settings show protection is enabled.
Which Windows versions are affected by the Defender bug?+
Microsoft lists Windows 10 versions 22H2, 21H2, Enterprise LTSC 2019 and Enterprise LTSC 2016; Windows 11 versions 26H1, 25H2, 24H2 and 23H2; and Windows Server versions 2025, 2022, 2019, 2016, 2012 R2 and 2012.
When will Microsoft fix the false Defender warning?+
Microsoft says the fix will arrive in a future Microsoft Defender Antivirus update, but it has not announced a release date.
Security Editor
Sophia unpacks the invisible wars happening on our networks. Covering cybersecurity, privacy legislation, and cryptography, she exposes how our data is weaponized and defended. Before joining for(geeks), she spent years as a penetration tester. She's the reason the rest of the team uses physical security keys.
