Microsoft Confirms False Reports That Defender Is Turned Off
Microsoft is tracking a bug in which Windows may report that Microsoft Defender Antivirus is turned off even when protection remains active.
False Microsoft Defender reports are a confirmed issue following the latest antivirus updates. Windows may tell users that “Microsoft Defender Antivirus is turned off,” even though protection is working correctly and its settings are active.
Microsoft opened a known-issue record on August 28, 2026. The bug affects supported client versions of Windows 10 and Windows 11, as well as Windows Server systems using the latest Defender updates.
False Microsoft Defender reports also appear after notifications are disabled
According to Microsoft, the incorrect alerts may appear when Windows starts or later while the device is being used. They may persist even after notifications are disabled, so suppressing them alone does not resolve the problem.
The company also states that this is not a confirmed security vulnerability or confirmed exploitation. In the described scenario, Microsoft Defender Antivirus should continue providing protection correctly, despite the system notification claiming otherwise.
Fix has no date or known version number yet
Microsoft is preparing a fix in a future Microsoft Defender Antivirus update. The company has not disclosed the exact update version that caused the incorrect behavior. It has also not provided a date for when the fix will become available.
For users, it is important to distinguish between this confirmed incorrect report and protection that is actually turned off. If Windows Security also shows that protection is active, the notification may be related to the documented bug. If protection is not active, the situation should be investigated as a real configuration or security-product operation issue.
Problem affects both client computers and servers
The scope is not limited to ordinary computers running Windows 10 and Windows 11. Microsoft also includes Windows Server among the affected systems, which is particularly relevant for administrators of corporate environments. False alarms may increase the number of security alerts and make it harder to distinguish an incorrect notification from a condition requiring intervention.
Microsoft has not confirmed so far that the bug itself reduces device protection. Nevertheless, it is advisable to monitor the issue status and the availability of the planned Defender update, especially on devices where the alert appears repeatedly.
Microsoft may later add the exact scope of the impact, the fixed-version number or a recommended procedure for checking Defender’s status. The record is currently listed as confirmed, not resolved.
Sources
- Microsoft Learn — Windows 11, version 24H2 known issues and notifications – Microsoft confirms the false reports, the scope of affected Windows and Windows Server versions, and that a fix is being prepared in a future Defender update.
- BleepingComputer — Microsoft asks users to ignore 'Antivirus is turned off' errors – Independently summarizes Microsoft’s notice and the story’s publication date of August 31, 2026.
Verified and updated: 08/31/2026 10:52
