Microsoft: Ignore the 'Antivirus Is Off' Warnings in Defender, It's a False Alarm
A bad notification, not a broken product. Microsoft says Defender is running normally despite pop-ups claiming otherwise, and a fix is on the way.
Key points
- Microsoft confirmed on Friday that recent Defender Antivirus updates trigger false warnings claiming the antivirus is switched off.
- Pop-ups appear at Windows startup and persist even when notifications are silenced.
- Every supported Windows version is affected, including Windows 11 26H1 and Windows Server 2025.
- The bug has been visible in the Windows Insider Release Preview Channel since June 2025.
- A patch ships in a future Defender update; no user action is required.
Microsoft is telling Windows users to ignore alerts warning that their built-in antivirus has been switched off. Defender is running. The notification is the bug, not the product.
The issue is documented on the Windows release health dashboard and was first reported by BleepingComputer. Affected machines show a message in the Windows Security app reading "Microsoft Defender Antivirus is turned off," prompting the user to turn it back on. Defender is already on.
"After installing the latest updates for Microsoft Defender Antivirus, notifications might appear stating that 'Microsoft Defender Antivirus is turned off,' even though the antivirus is functioning correctly and all settings show it as active," Microsoft wrote in its Friday advisory. Pop-ups arrive at boot and reappear intermittently afterward. Switching notifications off doesn't stop them.
What is actually broken?
The notification system, not the antivirus. Defender continues to scan files and block threats; the alert engine has simply started firing a warning that no longer matches reality.
For readers outside the security world: Microsoft Defender Antivirus is the tool built into Windows that watches for viruses and malicious software. It ships small updates several times a week, separately from the monthly Windows patches. One of those recent updates introduced the faulty alert.
Who is affected?
Every supported Windows client and server version, from older Windows 10 installations up to Windows 11 26H1 and Windows Server 2025. If you run Windows with Defender, you may see this.
A fix will arrive in a future Defender update, pushed automatically. Home users need do nothing. IT teams fielding help-desk tickets can point staff at the official advisory.
How long has this been happening?
Since June, quietly. The false alerts were visible in the Windows Insider Release Preview Channel, the testing ring where Microsoft trials updates before general release, for months before the company acknowledged them this week. The signal got lost in preview-build noise.
Recent history of phantom Windows errors
This isn't new behavior. Two weeks ago we reported that a faulty Defender signature update knocked out scanning entirely on Windows 10 and 11 machines. The table below shows how often Microsoft has asked users to disregard its own alerts this year.
| Date | Bogus alert | Trigger |
|---|---|---|
| April 2025 | 0x80070643 install failure | Windows Recovery Environment update |
| April 2025 | BitLocker encryption error | Windows 10 and 11 update |
| July 2025 | Windows Firewall warning after reboot | June 2025 preview update |
| August 2025 | CertificateServicesClient (CertEnroll) errors | July 2025 preview update |
| November 2025 | "Defender Antivirus is turned off" | Recent Defender definitions update |
Each one was harmless on its own. Together, they train users to ignore security warnings. A defender who's been told five times this year that the scary red alert is nothing turns into a defender who shrugs at the sixth, when it might be real.
What should users do now?
Nothing, beyond staying patched. Check the Windows Security app to confirm Defender is running; it will show green even while the pop-up complains. Wait for the corrective Defender update, which Microsoft will push automatically. Don't disable the antivirus to silence the message.
