Windows Security Says Defender Is Turned Off, But It Isn’t? Here’s What’s Going On

If Windows Security keeps popping up a warning that “Microsoft Defender Antivirus is turned off,” even though you never touched your settings and everything looks enabled when you check — you haven’t been hacked, and your protection almost certainly hasn’t actually been disabled. Microsoft has confirmed this is a bug, not a real security event.

What Microsoft Has Confirmed

According to Microsoft’s own release-health advisory, the false alerts started appearing after devices installed the latest Microsoft Defender Antivirus updates in late August 2026. The company’s statement is direct: “Microsoft Defender Antivirus remains active and functioning correctly” despite what the notification claims. The alert can appear at Windows startup and intermittently afterward, and — this is the part that trips people up — it persists even if you turn off notifications at the system level, which would normally silence it.

Microsoft opened this issue on August 28, 2026, and classified it as “Confirmed,” meaning they’ve reproduced it and agree it’s a real (cosmetic) bug — but as of this writing there’s no fix shipped yet, only a statement that they’re “working to release a resolution in a future Microsoft Defender Antivirus update.”

Why It Happens

Microsoft hasn’t published the technical root cause, but the pattern points to a status-reporting problem introduced by the Defender update itself, not an actual change to your protection state. In other words, the part of Windows Security that checks “is Defender on?” and displays a warning if not is misreading its own status after this update — the real, underlying protection engine keeps running normally the entire time.

How to Actually Verify You’re Protected

Don’t take the notification’s word for it either way — verify directly:

1. Open the Windows Security app and go to Virus & threat protection. If it shows real-time protection as On with no genuine active threats listed, you’re covered.
2. For a more technical check, open PowerShell and run Get-MpComputerStatus. Look for AntivirusEnabled : True and RealTimeProtectionEnabled : True.
3. If either of those genuinely shows disabled, that’s a real problem worth acting on — but the false alert itself, on its own, is not that signal.

What Not to Do

Don’t disable and re-enable Defender repeatedly trying to “fix” it — that doesn’t resolve a reporting bug and can occasionally leave real settings in an inconsistent state. Don’t install a second, third-party antivirus “just to be safe” on top of Defender either; running two real-time antivirus engines at once typically causes them to conflict and can actually degrade your protection rather than improve it. And don’t reflexively dismiss every future Windows Security warning as “probably that bug again” — security professionals are specifically advising people to verify each one through the Virus & threat protection screen rather than assuming, since a genuine alert could arrive at the same time.

How This Differs From the Other Recent Defender Bug

This isn’t the same issue as the Defender-related scan crashes some users saw earlier in August 2026, where quick and full scans were triggering access-violation crashes — that one has already been resolved through a signature update. The two are unrelated bugs from the same general update cycle, not the same problem showing up twice. If your scans were crashing rather than showing a false “turned off” warning, you were dealing with that separate, already-fixed issue.

Who’s Affected, and the Honest Limitation Here

This isn’t limited to one Windows version. Microsoft lists it as affecting Windows 11 (23H2 through 26H1), Windows 10 (21H2 and 22H2, plus LTSC editions), and Windows Server going back to 2012 R2 — essentially any system running an up-to-date Microsoft Defender Antivirus. The honest limitation is that there’s genuinely nothing you can do to make the notification stop for good right now; you can only confirm it’s false and wait for Microsoft’s patch. The only real lever to reduce how often you see it would be delaying that specific Defender Antivirus update, which isn’t advisable since it also carries real protection updates.

What to Expect Next

Microsoft’s advisory will be updated as the investigation progresses; there’s no ETA yet for a fix. For background on what else shipped in Windows Defender’s August 2026 update, see our full patch breakdown. If you’re running third-party antivirus software instead of Defender and running into unrelated errors, see our guide to fixing Panda Antivirus Error Code 10.

FAQ