Microsoft Defender Bug Triggers False “Antivirus Turned Off” Alerts on Windows

Microsoft has confirmed an issue with Microsoft Defender Antivirus that generates false notifications on Windows systems, claiming “Microsoft Defender Antivirus is turned off,” even though the protection is still operational.

These alerts may appear after installing the latest Defender updates, potentially causing unnecessary concern for administrators who observe that Defender settings are healthy and security controls are active.

Microsoft Defender Bug

According to Microsoft’s Windows health documentation, these notifications may appear at startup and can recur intermittently after signing in.

They may continue to appear even when notification settings are disabled, creating confusion for help desks and endpoint management teams. Microsoft stated that these alerts do not indicate a service failure or deactivated configuration.

The company has classified this condition as confirmed and is preparing a fix to be delivered through a future Microsoft Defender Antivirus update.

However, the August 28 health notice did not provide a resolution date, details about the affected Defender engine version, platform update identifier, or any mitigation measures. Microsoft will release more information as it becomes available.

The issue affects both client and server operating systems, meaning organizations should view it as a widespread management and user experience problem rather than a defect specific to a single Windows release.

Affected client platforms include Windows 11 versions 26H1, 25H2, 24H2, and 23H2, as well as Windows 10 versions 22H2 and 21H2. Additionally, Windows 10 Enterprise LTSC 2019 and Windows 10 Enterprise LTSC 2016 are also impacted.

On the server side, the notice includes Windows Server 2025, Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, and Windows Server 2012, all of which are affected when Defender runs updates.

For security operations teams, the critical distinction lies between a false user interface notification and a genuine endpoint protection failure.

Administrators can verify the product’s operational status through standard enterprise monitoring and local security controls before classifying it as an incident. The advisory states that antivirus functionality continues, and settings indicate that Defender is active.

The continued appearance of these messages, despite notification settings being disabled, may increase support requests and diminish confidence in endpoint status alerts.

It could complicate workflows that rely on user reports, screenshots, or desktop notifications as early indicators of potential control failures. Microsoft has not indicated any compromise, malware exposure, or loss of antivirus coverage in this notice.

Organizations should document this advisory in their service-desk guidance so that analysts can distinguish this known false alert from legitimate protection warnings.

They should continue to follow established procedures for investigating signs that Defender is unavailable, misconfigured, or impaired. Microsoft has not recommended disabling Defender, rolling back updates, or implementing any workaround while awaiting the update.

The issue was reported on August 28 at 3:34 PM Pacific Time and was last updated at 4:02 PM Pacific Time the same day. Microsoft plans to release a resolution in a future Defender update.

Until then, organizations should acknowledge the warning as a notification defect, rather than proof that antivirus protection has been disabled.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC