Windows devices that had been incorrectly warned that Microsoft Defender was turned off are no longer receiving the false alerts after a Defender update released on September 17, 2026. Microsoft’s updated support document states the problem has been resolved in Microsoft Defender Antivirus version 4.18.26080.4.
The bug caused the Windows Security app to frequently display a “Microsoft Defender Antivirus is turned off” alert and prompt users to turn protection back on, even though Defender was functioning and all settings showed it as active. Opening Windows Security typically returned users to the home tab, which showed antivirus status and the time of the last threat scan.
Reports of the false alerts first appeared in early August, and Microsoft acknowledged the issue at the end of August. Microsoft said the false notifications could appear after installing recent Defender updates and that the antivirus itself continued to function correctly despite the warning. The company did not identify which specific update caused the problem.
The issue affected all versions of Windows 11, Windows Server, and Windows 10. Microsoft also warned that Defender updates are distributed daily and cannot be treated like regular Windows updates that can be selectively removed.
Microsoft Defender fix and how to verify it
Microsoft says the fix should reach all PCs automatically unless mandatory security updates have been blocked using Registry Editor or Group Policy. The company noted: “After installing the latest updates for Microsoft Defender Antivirus, notifications might appear stating that ‘Microsoft Defender Antivirus is turned off,’ even though the antivirus is functioning correctly and all settings show it as active.”
To verify Defender is running, open Windows Security and check the current status; an active status and a recent threat scan time indicate protection is enabled. You can also run this PowerShell command to generate a security status report:
powershell -command “Get-MpComputerStatus | Select-Object AntivirusEnabled,RealTimeProtectionEnabled,AMServiceEnabled”
The command should return three values as True:
AntivirusEnabled : True
RealTimeProtectionEnabled : True
AMServiceEnabled : True
Microsoft did not provide additional details about why the issue persisted for nearly two months. The company is also managing other Windows 11 problems, including audio issues and errors affecting AMD-based PCs.
