Microsoft has resolved a known issue that causes incorrect alerts warning that Defender Antivirus was turned off after installing recent updates.
In a Windows release health dashboard update on Thursday, Microsoft said the issue was fixed in the Microsoft Defender Antivirus update (version 4.18.26080.4) released on September 17.
The company acknowledged the bug in late August, even though the issue had affected users in the Release Preview Channel of the Windows Insider program since at least June.
As Microsoft explained, this affects all supported Windows client and server versions, including the latest Windows 11 26H1 and Windows Server 2025 releases, and it triggers erroneous alerts in the Windows Security app that prompt users to “Tap or click to turn on Microsoft Defender Antivirus.”
“After installing the latest updates for Microsoft Defender Antivirus, notifications might appear stating that “Microsoft Defender Antivirus is turned off,” even though the antivirus is functioning correctly and all settings show it as active,” it said at the time.
“These notifications can appear when Windows starts and intermittently afterward. They persist even if notification settings are turned off.”
This isn’t the first time Microsoft asked customers to ignore incorrect errors and alerts displayed on their systems after installing updates.
In April 2025, the company addressed an issue that was triggering incorrect BitLocker drive encryption errors on Windows 10 and Windows 11 devices and fixed a bug that caused invalid 0x80070643 failure errors after installing the Windows Recovery Environment (WinRE) updates.
It also asked users in July 2025 to ignore erroneous Windows Firewall alerts that appeared after rebooting after installing the June 2025 preview update.
One month later, it warned that the July 2025 preview update and subsequent Windows 11 24H2 updates were causing incorrect CertificateServicesClient (CertEnroll) errors.
This week, Microsoft also released emergency Windows updates to fix Remote Desktop Services, Hyper-V, and USB audio issues caused by the September 2026 security updates.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Microsoft asks users to ignore ‘Antivirus is turned off’ errors
Microsoft: September updates cause RDS failures on Windows Server
Microsoft releases emergency Windows updates to fix RDS failures
Microsoft: August updates break printing, PDF export in WPF apps
Microsoft fixes Recycle Bin prompts broken by June Windows updates
I started getting those due to disabled sample submissions. Since I don’t want Microsoft to have all you can eat buffet with my files. And originally they would notification spam me about that, then suddenly notifications changed to antivirus disabled. When it actually wasn’t. Can’t help to wonder if it wasn’t deliberate mistake to scare people into enabling all options disguised as bug. Especially since for me that is happening for a while.
Click the dismiss button in “manage settings”
i saw 2 such messages that i remember. i thought it was odd. i checked and saw that, despite the messages to the contrary, windows defender was running properly, or at least that is what all of the indicators were showing me.
When I search for something in the Start menu and click Open, it doesn’t open. This is another bug.
Gyazo server flaw exploited to steal 23.6 million user records
Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer
ShinyHunters hacks Clop leak site, threatens to extort ransomware gang
Find out how long recovery really takes — and what it costs. Read the 2025 BCDR Report.
Automate Onboarding and Access Reviews with No-Code IGA: See how it works
Overdue a password health-check? Audit your Active Directory for free
Watch a working exploit hit live controls and see exactly what blocks, detects, or misses
Patch automation needs more than speed. Action1 brings control into every stage of deployment.
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
