Microsoft Confirms False Microsoft Defender Antivirus Alerts
Microsoft is tracking a bug in which Windows may report that Microsoft Defender Antivirus is turned off even when protection remains active.
False Microsoft Defender Antivirus alerts are a confirmed issue following the latest antivirus updates. Windows may tell users that “Microsoft Defender Antivirus is turned off,” even though protection is working correctly and its settings are active.
Microsoft opened a record for the known issue on August 28, 2026. The bug affects supported client versions of Windows 10 and Windows 11, as well as Windows Server systems using the latest Defender updates.
False Microsoft Defender alerts also appear after notifications are disabled
According to Microsoft, the incorrect warnings may appear when Windows starts or later while the device is in use. They may persist even after notifications are disabled, so suppressing them alone does not resolve the problem.
The company also states that this is not a confirmed security vulnerability or confirmed exploitation. In the described scenario, Microsoft Defender Antivirus should continue providing protection correctly, despite the system notification claiming otherwise.
Fix has no schedule or known version number yet
Microsoft is preparing a fix in a future Microsoft Defender Antivirus update. The company has not published the exact update version that caused the incorrect behavior. It has also not provided a date for when the fix will be available.
For users, it is important to distinguish this confirmed incorrect alert from genuinely disabled protection. If Windows Security also shows that protection is active, the notification may be related to the recorded bug. If protection is not active, the situation should be investigated as a real configuration or security-product issue.
Issue affects both client computers and servers
The scope is not limited to regular computers running Windows 10 and Windows 11. Microsoft also includes Windows Server in the impact, which is especially relevant for administrators of corporate environments. False alarms may increase the number of security alerts and make it more difficult to distinguish an incorrect notification from a condition requiring intervention.
Microsoft has not confirmed that the bug itself reduces device protection. Nevertheless, it is advisable to monitor the issue status and the availability of the planned Defender update, especially on devices where the alert appears repeatedly.
Microsoft may later add the exact scope of the impact, the corrected version number, or a recommended procedure for checking Defender’s status. The record is currently listed as confirmed, not resolved.
Sources
- Microsoft Learn — Windows 11, version 24H2 known issues and notifications – Microsoft confirms the false alerts, the scope of affected Windows and Windows Server versions, and that a fix is being prepared in a future Defender update.
- BleepingComputer — Microsoft asks users to ignore 'Antivirus is turned off' errors – Independently summarizes Microsoft’s announcement and the story’s publication date of August 31, 2026.
Verified and updated: August 31, 2026 10:52
