Microsoft fixes bug behind ‘Defender Antivirus is turned off’ alerts
Microsoft has resolved a known issue that causes incorrect alerts warning that Defender Antivirus was turned off after installing recent updates.
In a Windows release health dashboard update on Thursday, Microsoft said the issue was fixed in the Microsoft Defender Antivirus update (version 4.18.26080.4) released on September 17.
The company acknowledged the bug in late August, even though the issue had affected users in the Release Preview Channel of the Windows Insider program since at least June.
As Microsoft explained, this affects all supported Windows client and server versions, including the latest Windows 11 26H1 and Windows Server 2025 releases, and it triggers erroneous alerts in the Windows Security app that prompt users to "Tap or click to turn on Microsoft Defender Antivirus."
"After installing the latest updates for Microsoft Defender Antivirus, notifications might appear stating that "Microsoft Defender Antivirus is turned off," even though the antivirus is functioning correctly and all settings show it as active," it said at the time.
"These notifications can appear when Windows starts and intermittently afterward. They persist even if notification settings are turned off."
Defender Antivirus turned off alert (MarcelDekker)This isn't the first time Microsoft asked customers to ignore incorrect errors and alerts displayed on their systems after installing updates.
In April 2025, the company addressed an issue that was triggering incorrect BitLocker drive encryption errors on Windows 10 and Windows 11 devices and fixed a bug that caused invalid 0x80070643 failure errors after installing the Windows Recovery Environment (WinRE) updates.
It also asked users in July 2025 to ignore erroneous Windows Firewall alerts that appeared after rebooting after installing the June 2025 preview update.
One month later, it warned that the July 2025 preview update and subsequent Windows 11 24H2 updates were causing incorrect CertificateServicesClient (CertEnroll) errors.
This week, Microsoft also released emergency Windows updates to fix Remote Desktop Services, Hyper-V, and USB audio issues caused by the September 2026 security updates.
References in this story
- Microsoft asks users to ignore 'Antivirus is turned off' errors www.bleepingcomputer.com Microsoft asked customers this week to ignore alerts that Defender Antivirus has been turned off after installing the latest Defender updates.
- Windows 11, version 25H2 known issues and notifications learn.microsoft.com View announcements and review known issues and fixes for Windows 11, version 25H2
- www.reddit.com
- Microsoft warns of incorrect BitLocker encryption errors www.bleepingcomputer.com Microsoft warned customers this week of incorrect BitLocker drive encryption errors being shown in some managed Windows environments.
- Microsoft fixes bug causing incorrect Windows Recovery errors www.bleepingcomputer.com Microsoft says it resolved a known issue causing erroneous 0x80070643 failure errors when installing the April 2025 Windows Recovery Environment (WinRE) updates.
- Microsoft asks users to ignore Windows Firewall config errors www.bleepingcomputer.com Microsoft asked customers this week to disregard incorrect Windows Firewall errors that appear after rebooting their systems following the installation of the June 2025 preview update.
- Microsoft asks users to ignore certificate enrollment errors www.bleepingcomputer.com Microsoft has asked customers this week to disregard incorrect CertificateServicesClient (CertEnroll) errors that appear after installing the July 2025 preview update and subsequent Windows 11 24H2 updates.
- Microsoft releases emergency Windows updates to fix RDS failures www.bleepingcomputer.com Microsoft has released emergency out-of-band Windows updates to fix Remote Desktop Services failures caused by this month's security updates, along with Hyper-V and USB audio problems on some Windows versions.
