A Defender Antivirus update makes Windows 11 falsely warn virus protection is off (August 30, 2026)
Chapters
What the notification says
Microsoft's wording, quoted by Windows Latest, is that after installing the latest updates for Microsoft Defender Antivirus, notifications might appear stating that Microsoft Defender Antivirus is turned off, even though the antivirus is functioning correctly. On the machines seeing it, nothing has actually been switched off: real time protection is active and every setting still reports it as on.
Microsoft's release health dashboard carries the same problem under the title "Incorrect notifications that Microsoft Defender Antivirus is turned off", with a status of Confirmed and an originating update of N/A. Microsoft Learn records the entry as opened on August 28, 2026 at 15:34 PT and last updated at 16:02 PT that afternoon.
TL;DR
Windows 11 started showing notifications saying Microsoft Defender Antivirus is turned off while real time protection was still running, and Microsoft has confirmed the warning is false, according to Windows Latest on August 30, 2026. The notifications come from a Microsoft Defender Antivirus update rather than a Windows cumulative update, and they ignore your notification settings, so there is no way to switch them off. As of August 30, 2026 there is no fix, only a way to prove to yourself that Defender is on.
- The alert says to turn on virus protection, or that Microsoft Defender Antivirus is turned off, while Defender is working correctly.
- Microsoft opened the known issue at 15:34 PT on August 28, 2026 and last updated it at 16:02 PT the same day, with status Confirmed.
- The notifications appear when Windows starts and intermittently afterward, and they persist even if notification settings are turned off.
- The trigger is a Defender update, so the originating update is recorded as N/A and no Windows update can be uninstalled to remove it.
- There is no workaround for the notification. Get-MpComputerStatus is how you check whether you are actually protected.
Why you cannot turn the notifications off
Microsoft's own description is blunt about the part that makes this more than cosmetic: these notifications can appear when Windows starts and intermittently afterward, and they persist even if notification settings are turned off. Windows Latest reports the same thing from the user side, that the alerts bypass Windows notification settings, so switching notifications off or turning on Do Not Disturb does not stop them.
The cost of a false security alert is that people learn to dismiss security alerts. Anyone clearing this prompt several times a day is being trained to click through the next one, and the next one might be real. That is the reason to read this as a defect worth tracking rather than a nuisance worth ignoring.
Which Windows versions are affected
This is not tied to one build or one edition. Microsoft Learn lists the affected platforms across both client and server, which fits a problem delivered through Defender rather than through a monthly update.
Windows Latest describes the same spread from the reports it saw, naming Windows 11 23H2, 24H2 and 25H2, Windows 10 and Windows Server editions. Because the trigger is a Microsoft Defender Antivirus update, the dashboard records the originating update as N/A, and there is no Windows update to remove.
| Product | Versions Microsoft lists |
|---|---|
| Windows 11 | 26H1, 25H2, 24H2, 23H2 |
| Windows 10 | 22H2, 21H2 |
| Windows 10 LTSC | LTSC 2019, LTSC 2016 |
| Windows Server | 2012 through 2025 |
How to prove Defender is actually running
Windows Latest published the check on August 30, 2026. Open PowerShell and run this: powershell -command "Get-MpComputerStatus | Select-Object AntivirusEnabled,RealTimeProtectionEnabled,AMServiceEnabled". You want all three values to read True.
If AntivirusEnabled, RealTimeProtectionEnabled and AMServiceEnabled all read True, the notification is the bug and the machine is protected. If any of the three reads False, that is a different problem and worth treating as real, because this known issue is about a false message and not about protection actually stopping.
Where the fix stands as of August 30, 2026
No fix has shipped. Microsoft said it is working to release a resolution in a future Microsoft Defender Antivirus update, per Windows Latest, and it has published no date and no version for that update. Microsoft has published no workaround for the notification itself either.
What is still unknown as of August 30, 2026: which Defender version introduced the false message, how many machines are affected, and when the corrected Defender update lands. None of that is in the known issue, and I am not going to guess at it.
What you can do today
1. Run the status check before you change anything: powershell -command "Get-MpComputerStatus | Select-Object AntivirusEnabled,RealTimeProtectionEnabled,AMServiceEnabled". Confirm all three read True.
2. If they do, leave Defender alone. Turning protection off and on again, or installing a second antivirus product to silence the prompt, trades a false warning for a real gap.
3. Keep taking Defender updates. Microsoft says the resolution arrives in a future Defender update, so blocking those updates is the one action that guarantees you keep the message.
4. Tell the other people who use the PC that this particular prompt is false, and that the next security prompt after it closes deserves to be read rather than dismissed out of habit.
5. Check the known issue on Microsoft Learn before you assume it is over. The entry is where the resolution gets dated, and the last update to it was 16:02 PT on August 28, 2026.