Windows users have been dealing with another frustrating problem: the operating system can incorrectly warn that Microsoft Defender Antivirus has been turned off, even when the antivirus protection is still running normally.
Microsoft has officially confirmed the issue, making this more than just a collection of random user reports.
The timing could hardly be worse either. Fake antivirus warnings and security scams are already circulating online, meaning Windows itself is now capable of showing users an antivirus warning that simply isn’t true.
Microsoft Defender Says It Is Turned Off
According to Microsoft’s Windows release health documentation, affected systems may display notifications claiming that “Microsoft Defender Antivirus is turned off.”
However, Defender isn’t necessarily turned off at all.
Microsoft says the antivirus can remain active and function correctly while Windows displays the incorrect notification. Opening Windows Security may therefore show that protection is enabled despite Windows previously warning otherwise.
The notifications can appear when Windows starts and may return intermittently afterward.
More annoyingly, Microsoft says the incorrect notifications can continue appearing even when notification settings have been disabled.
It Isn’t Limited to One Windows 11 Version
This isn’t just a problem affecting one particular Windows 11 build.
Microsoft lists a wide range of affected operating systems, including Windows 11 26H1, 25H2, 24H2 and 23H2. Windows 10 versions and several Windows Server releases are also affected.
The issue appeared following recent Microsoft Defender Antivirus updates rather than being tied exclusively to one Windows feature update.
Microsoft confirmed the problem on August 28 and said it was working on a resolution through a future Microsoft Defender Antivirus update.
That’s Particularly Bad Timing
Normally, an incorrect Windows notification would mostly be an annoyance.
A false antivirus warning is different.
Cybercriminals have spent years training users to react immediately when they see messages claiming their computer is infected, unprotected or compromised. Fake antivirus scanners frequently imitate Microsoft and Windows Security interfaces to make their warnings appear legitimate.
A recent campaign discovered by Malwarebytes went even further.
Fake websites using Microsoft branding presented visitors with supposed security scans claiming that third-party antivirus software was causing problems with Windows. Victims were encouraged to uninstall their existing antivirus protection before being pushed toward a supposed refund process.
The entire scan was fake.
The goal was ultimately to convince victims to provide personal information, banking details or remote access to their computers.
Windows Creating Its Own False Warning Doesn’t Help
That creates an uncomfortable situation for users.
People are constantly told not to trust random antivirus warnings appearing on their screens. Now Windows itself can produce an incorrect warning about antivirus protection.
The legitimate Windows notification and malicious browser warnings are completely separate problems, but having both happening at roughly the same time makes identifying a genuine security issue more confusing than it needs to be.
Microsoft specifically warns that legitimate Windows error and warning messages do not contain telephone numbers.
If a supposed Microsoft security warning suddenly tells you to call a support number, install unknown software, provide payment information or grant someone remote access to your computer, treat it as suspicious.
Check Windows Security Before Panicking
If Windows suddenly claims Microsoft Defender Antivirus has been disabled, users should check Windows Security directly instead of immediately reacting to the notification.
Open Windows Security > Virus & threat protection and check the current protection status.
If Defender shows that protection is active and everything appears normal, the notification could be related to Microsoft’s confirmed bug.
Users can also manually run a Defender scan if they want additional reassurance.
Browser-based warnings should be treated differently. A website claiming it scanned your entire PC and discovered multiple viruses should not automatically be trusted, particularly if it immediately recommends downloading software or contacting a support number.
Windows Updates Are Having a Rough September
The antivirus notification problem also comes during another troublesome period for Windows updates.
Microsoft released an emergency out-of-band update in September after its latest security update introduced several problems across Windows.
Reported and confirmed issues included Remote Desktop Services becoming unresponsive, problems with USB audio devices and broken shared folders involving Hyper-V Linux virtual machines.
Microsoft’s September security update itself was enormous, addressing nearly 1,000 vulnerabilities.
An emergency update has since been released to resolve several of the problems.
It continues an uncomfortable pattern for Windows users in 2026, with Microsoft having already needed multiple out-of-band updates this year to repair problems introduced through regular updates.
Security Warnings Need to Be Reliable
Windows Security is one part of the operating system where incorrect information can cause genuine problems.
A broken Start menu or malfunctioning feature is frustrating. A security system incorrectly telling users that their antivirus has stopped working can teach people to ignore warnings that might eventually be important.
At the same time, fake antivirus scams continue becoming increasingly convincing.
For now, users seeing the Microsoft Defender warning should verify the status directly inside Windows Security rather than trusting the notification alone.
And if your “Windows security warning” suddenly wants you to call somebody, hand over banking information or install some mysterious virus scanner, don’t.
That one almost certainly isn’t Windows.
