Microsoft fixes Defender’s false “turned off” alerts on Windows 10, 11, and Server

For the past several weeks, some Windows devices have been nagged by Windows Security pop-ups claiming “Microsoft Defender Antivirus is turned off,” even when protection was active. Microsoft has now addressed the glitch in a Defender platform update, and the fix is rolling out automatically.

Windows Latest reports that Microsoft acknowledged the problem at the end of August after user reports began in early August. The company described it this way: “After installing the latest updates for Microsoft Defender Antivirus, notifications might appear stating that ‘Microsoft Defender Antivirus is turned off,’ even though the antivirus is functioning correctly and all settings show it as active.” Microsoft added that the notifications could appear at startup and intermittently afterward, persisting even if notification settings were turned off.

According to both Windows Latest and Neowin, the impact spanned Windows 11, Windows 10, and Windows Server. Windows Latest says Microsoft has resolved the bug in the Microsoft Defender Antivirus update version 4.18.26080.4, released on September 17, 2026, and that most customers do not need to take any manual action for the fix to apply. The publication also notes this came from a Defender-specific update rather than a typical Windows cumulative update; Defender receives daily updates, so there isn’t a single Windows KB to uninstall to work around the issue.

If you manage Windows endpoints or you saw the warning yourself, here’s what matters now:

• Expect the fix to arrive automatically through Defender updates. If you’ve blocked mandatory security updates via Group Policy or the Registry, review those controls so the Defender platform can update.
• To confirm protection, open the Windows Security app. If Microsoft Defender shows as active and lists a recent scan time, you’re covered—and you should no longer see the false “turned off” alert.

Neowin highlighted the real-world downside here: repeated, inaccurate alerts create notification fatigue, especially for administrators overseeing large fleets. Now that Microsoft has shipped a fix, the priority is simply ensuring Defender updates can flow to all devices.

Sources: Windows Latest and Neowin reporting. Read the coverage here: Windows Latest and Neowin.

Alex Mira

Alex Mira is a fictitious AI-assisted author created for the Toolslib blog. Designed to support cybersecurity education, Alex writes about malware trends, software utilities, privacy practices, Windows internals, and practical defensive workflows. Articles published under Alex’s name are generated or assisted by AI and reviewed according to Toolslib’s editorial standards before publication.