Skip to content
TroubleGrid

Windows says Microsoft Defender Antivirus is turned off when it isn't

Last verified September 2026Tested against Windows 11 26H1, Windows 11 25H2, Windows 11 24H2, Windows 11 23H2, Windows 10 22H2, Windows 10 21H2, Windows Server 2012 through 2025, Microsoft Defender Antivirus platform 4.18.26080.3 and earlier (affected), Microsoft Defender Antivirus platform 4.18.26080.4, released 17 September 2026 (carries the fix)Well documented

Microsoft resolved this on 17 September 2026, in Microsoft Defender Antivirus platform version 4.18.26080.4. Let Defender update itself, then check that Get-MpComputerStatus reports AMProductVersion as 4.18.26080.4 or later — the false alerts stop with that version. Until it reaches your PC the warning is cosmetic, but prove that before ignoring it: if AntivirusEnabled, RealTimeProtectionEnabled and AMServiceEnabled all read True, Defender is running and you are looking at the bug.

Start here

  1. Prove Defender is actually running, and read your platform version
  2. Update Defender to platform 4.18.26080.4 or later

The reason this one is worth two minutes rather than zero is that a disabled Defender is also what malware leaves behind, so "just ignore it" was bad advice even while the bug was unfixed. The check is quick and it distinguishes the two cases cleanly. Note the shape of the bug: the alert appeared at startup and at random afterwards, it kept appearing even after you turned Windows Security notifications off, and every settings page continued to show protection as on. It rode in on a Defender platform update rather than a Windows cumulative update, which is why it landed on Windows 10, Windows 11 and Windows Server at the same time — and why the fix arrives the same way.

Symptoms

  • A notification saying "Microsoft Defender Antivirus is turned off" or prompting you to turn on virus protection
  • It appears when Windows starts and then intermittently
  • It keeps appearing after you disable Windows Security notifications
  • Windows Security itself shows real-time protection as on with no threats
  • Manual scans and definition updates work normally
  • It started on a machine with no third-party antivirus installed

Why this happens

The notification came from Defender's reporting, not from Defender stopping

Microsoft's release-health entry lists the originating update as N/A and describes the alert appearing after the latest Microsoft Defender Antivirus updates, while the antivirus is functioning correctly and all settings show it as active. Because it rode on Defender's own updates rather than a Windows cumulative update, it turned up across Windows 10, Windows 11 and Windows Server at the same time, and uninstalling a Windows update would not clear it. Microsoft moved the entry to Resolved on 17 September 2026 and named platform 4.18.26080.4 as the version that fixes it.

Update Defender to platform 4.18.26080.4 or later · Prove Defender is actually running, and read your platform version

It was in the wild for two months before it was acknowledged

Reports go back to June 2026 in the Release Preview channel and to 25 July 2026 on Microsoft Q&A, where four people described the same behaviour on both preview and normal builds. Microsoft opened the known issue on 28 August and a moderator restated on 13 September that it was cosmetic. If you have been seeing this for weeks and could not find anything about it, that gap is why.

Prove Defender is actually running, and read your platform version · Update Defender to platform 4.18.26080.4 or later

Fixes

Prove Defender is actually running, and read your platform version

about 3 min

This separates the known bug from a genuinely disabled antivirus, which is the only distinction that matters here — and the same command tells you whether you already have the fixed version.

Applies to: Windows 10, Windows 11, Windows Server 2012 and later

  1. Right-click Start and open Terminal (Admin) or Windows PowerShell (Admin).
  2. Run this and read the values.
    Get-MpComputerStatus | Select-Object AntivirusEnabled, RealTimeProtectionEnabled, AMServiceEnabled, AMRunningMode, AMProductVersion, AntivirusSignatureLastUpdated
  3. If AntivirusEnabled, RealTimeProtectionEnabled and AMServiceEnabled are all True, Defender is running and the notification is the known bug. AntivirusSignatureLastUpdated should be recent, which confirms it is still getting definitions.
  4. AMProductVersion is your Defender platform version. 4.18.26080.4 or later is the build Microsoft says fixes the false alert; 4.18.26080.3 or earlier is still affected.
  5. If any of the three values is False, this article does not apply and you have a real problem. Open Windows Security and read what Virus & threat protection actually says, and check whether another antivirus product has taken over.
  6. As a second opinion, press Windows key + R, run services.msc, and confirm Microsoft Defender Antivirus Service (WinDefend) is Running.
    services.msc

Confirmed by the vendor.

Source: Microsoft, Microsoft Q&A, Microsoft

Update Defender to platform 4.18.26080.4 or later

about 10 min

This is the actual fix. It ships as a Defender platform update rather than through Windows Update's monthly cumulative cycle, so it arrives on its own schedule.

Applies to: Windows 10, Windows 11, Windows Server 2012 and later

  1. Open Windows Security, go to Virus & threat protection, and under Virus & threat protection updates click Check for updates.
  2. Alternatively force an update from an administrator Terminal.
    & "$env:ProgramFiles\Windows Defender\MpCmdRun.exe" -SignatureUpdate
  3. Restart the PC, then re-run the Get-MpComputerStatus check above and read AMProductVersion.
  4. Once AMProductVersion is 4.18.26080.4 or later, the false notification should stop. Microsoft published that version on 17 September 2026 as the resolution.
  5. If AMProductVersion is still 4.18.26080.3, the update has not reached your machine yet. Platform updates roll out gradually; leave the PC on and connected and check again in a day or two. The alert remains cosmetic in the meantime.

Confirmed by the vendor.

Source: Microsoft, Microsoft, Microsoft, BleepingComputer

Reset the Windows Security app

Check before applyingabout 10 min

Suggested by Microsoft staff on their own Q&A thread, for the case where the alert outlives the fixed platform version. It clears the app's local state, which is where the incorrect status is displayed.

Applies to: Windows 10, Windows 11

Before you do this

Resetting an app clears its stored settings. Any notification preferences, exclusions set through the app, or controlled folder access choices you made there may need to be set again. Do not turn off Tamper Protection while you do this.

  1. Only do this if AMProductVersion already reads 4.18.26080.4 or later and the alert has not stopped. Otherwise wait for the update instead.
  2. Open Settings, go to Apps, then Installed apps.
  3. Find Windows Security, open the three-dot menu, and choose Advanced options.
  4. Click Repair first. If the alert persists, come back and click Reset.
  5. Restart the PC, then re-run the Get-MpComputerStatus check from the first fix to confirm protection is still on.

Reported to work by one user; not confirmed by the vendor.

Source: Microsoft Q&A

Known issues

  • Incorrect notifications that Microsoft Defender Antivirus is turned off. Opened 28 August 2026 as Confirmed, and moved to Resolved on 17 September 2026. Microsoft states the issue was resolved in the Microsoft Defender Antivirus update version 4.18.26080.4, released that day, and that the antivirus remained active and functioning correctly throughout.

    Affects Windows 11 26H1, Windows 11 25H2, Windows 11 24H2, Windows 11 23H2, Windows 10 22H2, Windows 10 21H2, Windows Server 2012 through 2025, Defender platform 4.18.26080.3 and earlier · Status: fixed

  • Re-checked on 28 September 2026: the Microsoft Defender for Endpoint release notes still list platform 4.18.26080.3 (1 September 2026) as the newest Windows Antivirus release and still do not list 4.18.26080.4 — eleven days after the date Microsoft credits with the fix. The release-health dashboard names 4.18.26080.4, so the two Microsoft pages continue to disagree. Read AMProductVersion on your own PC rather than either page to know what you have.

    Affects Defender platform 4.18.26080.3, Defender platform 4.18.26080.4 · Status: unknown

  • Still no independent confirmation that 4.18.26080.4 stops the alert, re-checked 28 September 2026. BleepingComputer reported the fix on 18 September 2026, but relays Microsoft's own resolution statement rather than verifying the notifications stopped. The Microsoft Q&A thread that tracked this — seven posters, latest post 14 September 2026 — names no fixed version, and the one report of the alerts stopping cites security intelligence 1.457.423.0, a signature rather than platform version.

    Affects Defender platform 4.18.26080.4 · Status: unknown

If none of this worked

If Get-MpComputerStatus reports False for any of the three values, Defender really is off and this article is not your answer. The common innocent reason is a third-party antivirus, which Windows lets take over while Defender steps back. The one that matters is malware, which disables real-time protection and Tamper Protection to stay hidden. Check Windows Security > Virus & threat protection > Manage settings and confirm Tamper Protection is on. If it is off and you did not turn it off, treat the machine as compromised and scan it with the Microsoft Defender Offline scan before doing anything else. A Group Policy or registry setting such as DisableAntiSpyware will also genuinely turn Defender off on managed machines, which is a question for whoever manages the PC rather than a fault to fix yourself.

Common questions

Is my PC unprotected while this alert is showing?
Not if Get-MpComputerStatus reports AntivirusEnabled, RealTimeProtectionEnabled and AMServiceEnabled as True. Microsoft's own advisory stated the antivirus remains active and functioning correctly despite the notification, and a Microsoft Q&A moderator called it purely cosmetic on 13 September 2026.
How do I know whether I have the fixed version?
Run Get-MpComputerStatus and read AMProductVersion. That is the Defender Antivirus platform version. Microsoft says 4.18.26080.4, released 17 September 2026, carries the fix; 4.18.26080.3 or earlier is still affected. Do not confuse it with the security intelligence version, which changes several times a day and is not what Microsoft credited with the fix.
Why can't I turn the notification off?
Microsoft documents that these notifications persist even when notification settings are turned off. That is part of the bug, not something you have configured wrong. The fix is the updated Defender platform, not a notification setting.
Should I install a different antivirus because of this?
No. Installing a second antivirus to silence a false alert leaves you with a real change to your security setup for a problem that is cosmetic and now fixed.
Will uninstalling a Windows update fix it?
No. Microsoft lists the originating update as N/A, which means it came with a Defender Antivirus update rather than a Windows cumulative update. Removing a Windows update will not touch it, and removing a security update to chase a cosmetic alert is a bad trade.

Did this fix work?

If a step is wrong, outdated, or did not help, telling us is the fastest way to get it corrected. Reports are reviewed before new articles.

Report a problem with this page

Related problems

Sources

  • Windows 11, version 25H2 known issues and notificationsOfficial

    Microsoft · Support page · checked Sep 28, 2026

    • Microsoft opened the known issue "Incorrect notifications that Microsoft Defender Antivirus is turned off" on 28 August 2026
    • The status changed to Resolved on 17 September 2026 at 18:22 PT
    • Microsoft states the issue was resolved in the Microsoft Defender Antivirus update version 4.18.26080.4, released on 17 September 2026
    • The notifications appeared after installing the latest updates for Microsoft Defender Antivirus, even though the antivirus was functioning correctly and all settings showed it as active
    • The notifications can appear when Windows starts and intermittently afterward, and persist even if notification settings are turned off
    • The issue could be observed in any version of Windows or Windows Server with Microsoft Defender Antivirus running the latest Defender updates
    • Affected platforms include Windows 11 26H1, 25H2, 24H2 and 23H2, Windows 10 22H2 and 21H2, the Windows 10 Enterprise LTSC releases, and Windows Server 2012 through 2025
    • The originating update field is N/A, so the notification was not tied to a specific Windows cumulative update
  • Microsoft Defender for Endpoint release notesOfficial

    Microsoft · Documentation · checked Sep 28, 2026

    • As of 18 September 2026 this page lists Windows Antivirus Platform 4.18.26080.3 with Engine 1.1.26080.3, released 1 September 2026, as the most recent Windows Antivirus release
    • The page does not yet list platform version 4.18.26080.4 that the Windows release-health dashboard names as carrying the fix
    • Defender Antivirus platform and engine versions are released separately from Windows cumulative updates
  • Get-MpComputerStatus (Defender)Official

    Microsoft · Documentation · checked Sep 28, 2026

    • Get-MpComputerStatus gets the status of antimalware software installed on the computer
    • Its output includes AntivirusEnabled, RealTimeProtectionEnabled, AMServiceEnabled, AMRunningMode, AMProductVersion, AMEngineVersion, AMServiceVersion, AntispywareEnabled, BehaviorMonitorEnabled and AntivirusSignatureLastUpdated
    • AMProductVersion is the Defender Antivirus platform version reported by the cmdlet
  • Microsoft asks users to ignore 'Antivirus is turned off' errorsReputable

    BleepingComputer · News · checked Sep 28, 2026

    • The false notifications affected users in the Windows Insider Release Preview Channel since June 2026, months before Microsoft acknowledged them in late August
    • Microsoft advised users to disregard the alerts because the antivirus is working properly
    • The erroneous alerts appear in the Windows Security app and prompt users to "Tap or click to turn on Microsoft Defender Antivirus"
    • A reader comment dated 31 August 2026 reports the notifications stopped after Defender security intelligence version 1.457.423.0 installed automatically
    • At the time of writing Microsoft said a permanent fix would come in a future Defender Antivirus update, with no release date given
  • Microsoft fixes bug behind 'Defender Antivirus is turned off' alertsReputable

    BleepingComputer · News · checked Sep 28, 2026

    • Microsoft Defender Antivirus update version 4.18.26080.4 was released on 17 September 2026 and resolves the false "turned off" notifications
    • The issue affected all supported Windows client and server versions, including Windows 11 26H1 and Windows Server 2025
    • The report, published 18 September 2026, relays Microsoft's resolution statement rather than independently verifying that the notifications stop
  • Defender Antivirus "turned off" — Microsoft Q&ACommunity report

    Microsoft Q&A · Forum · checked Sep 28, 2026

    • Four distinct users reported the notification between 25 July and 16 August 2026, before Microsoft acknowledged it
    • Reporters describe all protection toggles enabled, antivirus updates working and manual scans running normally while the warning keeps appearing
    • It is reported on both Release Preview builds and on the normal August 2026 build 26200.9168
    • A moderator confirmed on 13 September 2026 that this is a known issue and is purely cosmetic
    • Microsoft staff on the thread recommend running Get-MpComputerStatus and checking AntivirusEnabled, RealTimeProtectionEnabled and AMServiceEnabled, and treating all-True as a false notification
    • Microsoft staff also recommend confirming the WinDefend service is running in services.msc, and resetting the Windows Security app from Settings > Apps > Installed apps > Windows Security > Advanced options > Reset
    • As of 18 September 2026 no post in the thread confirms that a specific Defender version stopped the alerts
"Defender Antivirus is turned off" but it isn't | TroubleGrid