Microsoft: Ignore the 'Antivirus Is Off' Warnings in Defender, It's a False Alarm

Key points

• Microsoft confirmed on Friday that recent Microsoft Defender Antivirus updates trigger false warnings claiming the antivirus is switched off.
• The pop-ups appear at Windows startup and keep returning even when notifications are silenced.
• The bug affects every supported version of Windows, including Windows 11 26H1 and Windows Server 2025.
• The problem has been visible in the Windows Insider Release Preview Channel since June 2025.
• A patch will ship in a future Defender update; no user action is required.

Microsoft is telling Windows users to ignore alerts warning that their built-in antivirus has been switched off. It hasn't. The software is running normally. The notification itself is the bug.

The issue is documented on the Windows release health dashboard and was first reported by BleepingComputer. Affected machines show a message in the Windows Security app reading "Microsoft Defender Antivirus is turned off," and prompt the user to tap or click to turn it back on. Defender is, in fact, already on.

"After installing the latest updates for Microsoft Defender Antivirus, notifications might appear stating that 'Microsoft Defender Antivirus is turned off,' even though the antivirus is functioning correctly and all settings show it as active," Microsoft wrote in its Friday advisory. The pop-ups arrive when Windows boots and reappear at random afterwards. Switching notifications off doesn't stop them.

What is actually broken?

The notification system, not the antivirus. Defender continues to scan files and block threats. The alert engine that decides when to warn the user has simply got its wires crossed and is firing a warning that no longer matches reality.

For readers who don't live in this world: Microsoft Defender Antivirus is the security tool built into Windows that watches for viruses and other malicious software. It is on by default. The company ships small updates to it several times a week, separately from the big monthly Windows patches. One of those recent updates introduced the faulty alert.

Who is affected?

Every supported version of Windows on the client and server side, from older Windows 10 installations up to the newest Windows 11 26H1 release and Windows Server 2025. If you run Windows and Defender, you may see this.

Microsoft says a fix will arrive in a future Defender update, delivered automatically. Home users don't need to do anything. IT teams fielding help-desk tickets can point staff at the official advisory to calm nerves.

How long has this been happening?

Since June, quietly. The false alerts have been visible in the Windows Insider Release Preview Channel (the testing ring where Microsoft trials updates before general release) for months. Microsoft only acknowledged the problem this week, which suggests the signal got lost in the noise of preview builds.

Recent history of phantom Windows errors

This is becoming a pattern. Microsoft has spent the past year telling users to disregard a string of misleading alerts triggered by its own updates.

Each one was harmless on its own. Together, they train users to ignore security warnings, which is the real cost. A defender who has been told five times this year that the scary red alert is nothing turns into a defender who shrugs at the sixth one, when it might be real.

What should users do now?

Nothing, beyond staying patched. Check the Windows Security app if you want to confirm Defender is running (it will show green even while the pop-up complains). Wait for the corrective Defender update, which Microsoft will push automatically. Don't disable the antivirus to silence the message.