Microsoft has confirmed a bug that makes Windows show a false Microsoft Defender Antivirus notification claiming protection is switched off, on PCs where Defender is running normally. The entry was added to Microsoft’s Windows release health dashboard on 28 August 2026 at 15:34 PT and carries the status Confirmed.
The important detail, and the one that changes what you should do about it, is what Microsoft lists as the originating update: N/A. The dashboard lists no originating update, and Microsoft attributes the notifications to “the latest updates for Microsoft Defender Antivirus” — Defender’s own update channel rather than any particular Windows release.
What the Microsoft Defender notification bug actually does
Here is how Microsoft describes it on the release health dashboard:
notifications might appear stating that “Microsoft Defender Antivirus is turned off,” even though the antivirus is functioning correctly and all settings show it as active
Microsoft says the notifications can appear when Windows starts and intermittently afterwards, and that they persist even if notification settings are turned off. That last part is the genuinely annoying bit: by Microsoft’s own account, turning system notifications off does not suppress this one.
Which versions are affected
Microsoft states the issue can be observed in any version of Windows or Windows Server with Microsoft Defender Antivirus running with the latest Defender updates. The dashboard lists the affected platforms as:
- Windows 11: version 26H1, version 25H2, version 24H2, version 23H2
- Windows 10: version 22H2, version 21H2, Enterprise LTSC 2019, Enterprise LTSC 2016
- Windows Server: 2025, 2022, 2019, 2016, 2012 R2, 2012
That is wider than a typical single-build issue, which is consistent with the cause sitting in Defender’s own update channel rather than in any one OS build.
How to check whether Defender is actually running
Do not simply assume the alert is noise. Fake security warnings are a standard malware and tech-support-scam tactic, so it is worth spending thirty seconds confirming your machine is genuinely protected before you dismiss anything.
- Open the Windows Security app from the Start menu.
- Select Virus & threat protection.
- Select Manage settings under Virus & threat protection settings.
- Confirm the Real-time protection toggle is set to On.
If you would rather check it without the interface, Microsoft’s Defender PowerShell module reports the same state. Open PowerShell and run:
Get-MpComputerStatus | Select-Object AntivirusEnabled,RealTimeProtectionEnabled,AMServiceEnabled
On a protected PC, all three values return True. If they do, the notification is the bug described above and your antivirus is working, whatever the pop-up says.
When will Microsoft fix it?
Microsoft’s next steps on the dashboard say it is working to release a resolution in a future Microsoft Defender Antivirus update, and will provide more information when it is available. No date has been attached to that.
Worth saying plainly: a security app that repeatedly cries wolf is a security problem in itself. Every false notification of this kind trains users to swipe away exactly the kind of warning they should read, and Microsoft’s own text concedes the alert survives notification settings being switched off, so there is no clean way for an affected user to silence a false alarm about their own defences. This also arrives alongside a separate confirmed bug in which Windows 11 loses custom mouse cursor settings after KB5120998.
Source: Microsoft Windows release health
