“Microsoft Defender Antivirus is turned off” notification: false alarm or real?

The known issue behind the false alerts

Microsoft’s Windows release health page lists an issue titled “Incorrect notifications that ‘Microsoft Defender Antivirus is turned off’”. In summary:

Detail	What Microsoft says
Cause	Microsoft Defender Antivirus platform update 4.18.26070.9, released August 5, 2026
Symptom	Notifications that Defender is turned off, at startup and now and then afterwards, even though it’s working and all settings show it active
Affected	Windows 11 (26H1, 25H2, 24H2, 23H2), Windows 10 (22H2, 21H2 and LTSC editions) and Windows Server 2012 to 2025
Fix	Defender platform update 4.18.26080.4, released September 17, 2026
Status	Resolved (marked resolved on September 30, 2026)

Because it came through a Defender update rather than a monthly Windows update, there was no KB to uninstall. Microsoft didn’t offer a workaround; the fix was the corrected Defender update.

Check whether Defender is really off

Don’t trust the pop-up alone. Check the real state:

1. Open Windows Security and select Virus & threat protection. A green tick and no warning means protection is on.
2. Under Virus & threat protection settings, select Manage settings and check that Real-time protection is on.
3. If you have another antivirus app, select Manage providers under Who’s protecting me? to see which product Windows treats as active.

For a definite answer, open PowerShell as administrator and run:

Get-MpComputerStatus | Select-Object AMRunningMode, AntivirusEnabled, RealTimeProtectionEnabled, AMProductVersion

Result	What it means
AMRunningMode is Normal and the other values are True	Defender is on. A “turned off” alert was false.
AMRunningMode is Passive	Another antivirus is the main one; Defender is standing by. This is normal.
AntivirusEnabled or RealTimeProtectionEnabled is False	Protection really is off. See When the notification is real.

If Windows Security won’t open at all, fix that first with Windows Security not opening in Windows 11.

Make sure you have the fixed version

The AMProductVersion value from the command above is the Defender platform version. It should be 4.18.26080.4 or later; newer monthly releases such as the October 2026 one already include the fix. You can also see it in Windows Security > Settings > About.

If yours is older:

1. Open Windows Security > Virus & threat protection > Protection updates and select Check for updates.
2. Open Settings > Windows Update and install what’s offered. Microsoft delivers Defender platform updates through Windows Update as KB4052623.
3. Restart the PC and run the PowerShell check again.

Update-MpSignature and MpCmdRun.exe -SignatureUpdate update security intelligence (the virus definitions). That’s worth doing, but it’s the platform update that fixes this bug, so check AMProductVersion afterwards.

When the notification is real

• Another antivirus is installed. Microsoft’s compatibility documentation says Defender turns itself off on Windows 10 and 11 when you install another compatible antivirus. On Windows 11 with Smart App Control on, it may show as passive instead. You can still turn on Periodic scanning under Virus & threat protection > Microsoft Defender Antivirus options if you want Defender to scan occasionally alongside the other product.
• The other antivirus expired or was removed. Microsoft says Defender turns back on automatically when another product expires, is uninstalled or stops providing real-time protection. A short gap while that happens can trigger the warning. If you’ve stopped paying for a third-party suite, uninstall it fully.
• Real-time protection was switched off. Microsoft’s Windows Security help notes that if you turn it off, it turns back on automatically after a short time. If it stays off, a policy is setting it.
• A work or school policy controls it. On a managed PC, your IT team’s settings decide this. Ask them before changing anything.
• Something else turned it off. If none of the above applies and Defender keeps switching off, treat it as a possible infection. Run Virus & threat protection > Scan options > Microsoft Defender Offline scan and keep Tamper Protection on under Manage settings.

Smart App Control interacts with Defender’s mode on Windows 11; see Smart App Control blocked an app for what it does.

Why turning off notifications didn’t help

Many people tried Windows Security > Settings > Manage notifications. Microsoft’s notification settings page explains that those switches only cover informational messages; alerts about problems that need action always appear. Microsoft’s known-issue entry also said the false notifications kept appearing even with notification settings off. The fix had to come from the corrected Defender update.

Fixes to avoid

• Don’t use old registry tweaks such as DisableAntiSpyware or disable services to stop the message. Tamper Protection blocks many of these changes, and they can leave you with no antivirus at all.
• Don’t roll Defender back to an older platform version to stop the alert. You’d lose current protection, and the fixed version is already out.
• If you manage devices, don’t remove antivirus compliance rules because of this alert. Update the devices instead.

Defender also warns about other security features that are off, such as memory integrity. Those warnings are separate; see Memory integrity is off because of incompatible drivers.

Related guides

• Windows Security not opening in Windows 11? 7 fixes that work
• Smart App Control blocked an app: what it means and what to do
• Memory integrity is off because of incompatible drivers: how to fix it
• “Unauthorized changes blocked” in Windows Security: what it means and how to fix it

Official sources

• Resolved issues in Windows 11, version 25H2 (Windows release health)
• Microsoft Defender Antivirus compatibility with other security products (Microsoft Learn)
• Stay protected with Windows Security (Microsoft Support)