Microsoft has told Windows users to ignore false Microsoft Defender Antivirus alerts claiming the security software has been switched off, after the latest Defender updates were installed.
The warning is appearing in the Windows Security app on affected devices, despite Defender continuing to operate normally and its settings showing that protection remains active.
Microsoft said the issue affects all supported Windows client and server editions, including Windows 11 26H1 and Windows Server 2025. It has been reported among members of the Windows Insider Release Preview Channel since June.
In an update to its health dashboard, Microsoft said notifications could appear when a computer starts and then return intermittently. They may continue to be displayed even when notification settings have been disabled.
The messages invite users to “Tap or click to turn on Microsoft Defender Antivirus”. However, Microsoft said: “After installing the latest updates for Microsoft Defender Antivirus, notifications might appear stating that ‘Microsoft Defender Antivirus is turned off,’ even though the antivirus is functioning correctly and all settings show it as active.”
The company is working on a remedy and said it would distribute the fix through a future Microsoft Defender Antivirus update. Until then, users who see the warning should check the Windows Security app rather than assuming that their antivirus protection has failed.
Microsoft has previously had to reassure customers about inaccurate warnings generated after software updates, including false Windows Firewall alerts in 2025 and incorrect BitLocker and CertificateServicesClient error messages on Windows devices.
