Microsoft confirmed that recent Windows updates are causing false alerts claiming Microsoft Defender Antivirus is turned off, though the antivirus remains active.
Microsoft has acknowledged a widespread issue causing false notifications on Windows devices, warning users that Microsoft Defender Antivirus is turned off when the antivirus is actually functioning correctly. The company confirmed the alerts stem from recent updates, though a fix remains pending. Users are being urged to verify their antivirus status through built-in tools, as the warnings persist despite notification settings being disabled.
False Alerts Stem from Recent Updates, Microsoft Confirms
The false alerts began appearing after recent Windows updates, with users reporting pop-ups stating Turn on virus protection
even when Defender was active. Microsoft confirmed the issue in a statement, noting that these notifications can appear when Windows starts and intermittently afterward. They persist even if notification settings are turned off. The company emphasized that the antivirus is functioning correctly and all settings show it as active, but a resolution is still under development.
Windowslatest reported that the Turn on virus protection
pop-ups occur randomly during system boot or regular use, misleading users into believing their protection is disabled. The issue is tied to updates for Microsoft Defender Antivirus and affects all versions of Windows, including 23H2, 24H2, 25H2, and even Windows 10, as long as Defender is not paused. The alert bypasses Windows Notifications settings, the outlet noted, so disabling system-wide notifications or using Do Not Disturb will not stop the alerts.
Antivirus Is Turned Off’—Microsoft Confirms Windows Update Mistake
Users Advised to Verify Antivirus Status Manually
Despite the false warnings, Microsoft urged users to confirm their antivirus status through Windows Security. Do not just dismiss the alert, assuming it to be a false alarm,
Windowslatest advised. Users can check if Defender is running by opening Windows Security, navigating to Virus & threat protection,
and ensuring real-time protection is enabled. A command-line tool, sc query WinDefend, can also verify Defender’s status, with the expected output being STATE : 4 RUNNING.
On a properly protected system, all three values should read True. The outlet also warned against uninstalling or reinstalling antivirus software based on the alerts, stating that Defender keeps working even if the banner or icons say otherwise.
Microsoft Working on Fix, but Users Remain Concerned
Microsoft stated it is working to release a resolution in a future Defender update but has not yet provided a timeline. We are working to release a resolution in a future Microsoft Defender Antivirus update and will provide more information when it is available,
the company said. However, users remain wary, given the potential for malware to exploit similar false alerts. It's only natural to be a little bit worried,
XDA-Developers noted, if you've been getting spammed by notifications claiming 'Microsoft Defender Antivirus is turned off' when everything seems okay.
Windows 11 is warning "Virus protection is off," Microsoft
Windowslatest highlighted that the issue first emerged in early August and has since escalated, with reports increasing over the past few days. The outlet also mentioned that Microsoft’s Jen Gentleman, a software engineer, confirmed the company was investigating the problem about two weeks prior. Despite this, no immediate solution has been released, leaving users to rely on manual verification until a patch is issued.
Specific Builds and Update Details
The issue has been tied to specific Windows 11 builds, including reports that traced it to an update on August 4. The alerts tend to cluster around builds from the Windows Insider Release Preview channel in July of this year (26100.8968/26200.8968, then 26100.8973/26200.8973 via KB5101684). Some reports come from users not in the Insider program, suggesting the issue may not be exclusive to preview channels. Microsoft has not yet listed the problem on its official known issues pages for 25H2 or 24H2, though the company acknowledged the problem in an updated support document.
Technical Details and Compatibility
Windows Security Center reads the virus status from either Defender or a third-party antivirus app and then displays the warning. If that sync misfires, the UI can misreport an error. Microsoft notes, “If you do disable the Windows Security app, or configure its associated Group Policy settings to prevent it from starting or running, the Windows Security app might display stale or inaccurate information about any antivirus or firewall products that are installed on the device.” This applies to users running Defender alongside third-party antivirus software.
Don't panic over Windows' new 'no antivirus detected' warning
Additional Verification Steps
To ensure protection, users can run a quick scan via Windows Security or download an EICAR test file to verify detection functionality. The EICAR test file is a standard tool for checking antivirus responsiveness without risking real malware. Microsoft also emphasized that Windows 7 users are unaffected, as Defender updates are no longer released for that OS.
Industry Reactions and Ongoing Concerns
Independent reviewers and outlets have emphasized the importance of user vigilance. Yahoo advised, If you've double-checked that it's still on, you have nothing to worry about.
However, the persistent nature of the alerts underscores the need for caution, especially as cyber threats evolve. The incident highlights the challenges of balancing user alerts with technical accuracy, as false positives can erode trust in security systems.
Microsoft’s Acknowledgment and Future Steps
Microsoft’s acknowledgment of the issue marks a step toward transparency, though the lack of a quick fix leaves many users navigating uncertainty. The company has not provided a specific release date for the resolution, but it has confirmed the problem is under investigation. Until then, users are encouraged to rely on manual checks and avoid altering antivirus settings based on the false alerts.
