Microsoft Tells Users to Ignore False 'Antivirus Is Turned Off' Alerts

This false notification appears in the Windows Security app after installing the latest Defender Antivirus updates, telling users to "Tap or click to turn on Microsoft Defender Antivirus," even though the antivirus engine is running and every visible setting shows it as active, according to Microsoft's release health dashboard update reported by BleepingComputer.

Microsoft said the notifications can surface when Windows starts and then reappear intermittently afterward. Crucially, the alerts persist even if a user or administrator has turned off notification settings entirely, meaning the usual workaround of muting alerts does not stop them from popping up again.

Microsoft said the known issue affects all supported Windows client and server versions, including the latest Windows 11 26H1 and Windows Server 2025 releases. That breadth means the bug is not limited to a single feature update or edition, but ties to the Defender Antivirus update itself rather than the underlying Windows build.

The problem first appeared in the Windows Insider program's Release Preview Channel back in June, months before Microsoft acknowledged it publicly. According to BleepingComputer, it appears Microsoft didn't notice the issue until now.

For managed environments, a false antivirus shutoff warning is more than cosmetic. Help desks and MSPs monitoring endpoint fleets rely on Windows Security status signals, and a bug that fires falsely on every supported version can generate unnecessary tickets and alert fatigue at scale.

• Repeated false alerts can train users to dismiss real Defender shutoff warnings.
• Support teams may waste time investigating a non-existent antivirus outage.
• Automated monitoring tools that key off this notification string could potentially misreport endpoint health, though this has not been confirmed.

Microsoft addressed the issue in a Friday update to its release health dashboard, stating that after installing the latest Defender Antivirus updates, "notifications might appear stating that 'Microsoft Defender Antivirus is turned off,' even though the antivirus is functioning correctly and all settings show it as active." The company confirmed it is working on a fix.

Microsoft has not published a timeline, saying only that the fix will ship in "a future Microsoft Defender Antivirus update." No workaround has been offered beyond disregarding the notification, since disabling alerts does not stop the bug from recurring.

This is not the first time Microsoft has asked customers to disregard incorrect alerts following an update. In April, the company fixed a bug that caused invalid 0x80070643 failure errors after the April 2025 Windows Recovery Environment updates, and separately addressed false BitLocker drive encryption errors on Windows 10 and Windows 11.

In July 2025, Microsoft told users to ignore erroneous Windows Firewall alerts that appeared after rebooting following the June 2025 preview update. A month later, it acknowledged that the July 2025 preview update and later Windows 11 24H2 updates were triggering incorrect CertificateServicesClient (CertEnroll) errors.

Until Microsoft releases a fix, administrators can verify actual Defender Antivirus status through Windows Security settings, rather than relying on the pop-up notification alone. If those checks confirm real-time protection is active, the alert can be treated as a known display issue.

MSPs and IT teams monitoring multiple endpoints should flag this known issue internally so help desk staff do not escalate false shutoff reports as security incidents. Microsoft has not indicated any additional configuration change or registry workaround, so the practical guidance for now is confirmation, not remediation.

The false Defender 'turned off' alert creates unnecessary alarm and support load without any real drop in protection, since Defender Antivirus keeps running normally on affected systems.

Security: No actual antivirus coverage is lost; Microsoft confirms Defender Antivirus continues functioning correctly and all settings show it as active despite the alert.

Microsoft confirmed that recent Defender Antivirus updates trigger a false 'turned off' notification on fully protected Windows systems and asked users to disregard it.