Microsoft asked customers this week to ignore incorrect alerts that Defender Antivirus has been turned off after installing the latest Defender updates.
Although this issue has been affecting users in the Release Preview Channel of the Windows Insider program since June, it appears Microsoft didn’t notice it until now.
The erroneous alerts appear on affected systems in the Windows Security app and prompt users to “Tap or click to turn on Microsoft Defender Antivirus.”
The known issue affects all supported Windows client and server versions, including the latest Windows 11 26H1 and Windows Server 2025 releases.
“After installing the latest updates for Microsoft Defender Antivirus, notifications might appear stating that “Microsoft Defender Antivirus is turned off,” even though the antivirus is functioning correctly and all settings show it as active,” Microsoft explained in a Friday release health dashboard update.
“These notifications can appear when Windows starts and intermittently afterward. They persist even if notification settings are turned off.”
Microsoft says it’s working on a fix and will release it to affected customers in a future Microsoft Defender Antivirus update.
This isn’t the first time Microsoft has told customers to ignore incorrect alerts and errors being displayed on their systems after installing updates.
In April, the company confirmed and fixed a bug that caused invalid 0x80070643 failure errors after installing the April 2025 Windows Recovery Environment (WinRE) updates and addressed an issue that was triggering incorrect BitLocker drive encryption errors on Windows 10 and Windows 11 devices.
In July 2025, it also asked users to disregard erroneous Windows Firewall alerts that appeared after rebooting following the installation of the June 2025 preview update.
One month later, Microsoft said that the July 2025 preview update and subsequent Windows 11 24H2 updates were triggering incorrect CertificateServicesClient (CertEnroll) errors.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Microsoft: August updates break printing, PDF export in WPF apps
Microsoft fixes Recycle Bin prompts broken by June Windows updates
New Windows RasMan zero-day flaw gets free, unofficial patches
Microsoft fixes GIF functionality in the Windows Emoji Panel
Microsoft rolls out fix for Windows 11 crashes, gaming issues
68-year-old imprisoned after making $1.3 million by pirating IPTV services
Anthropic is cutting Claude Code’s current weekly limits by 17%
McKesson discloses breach after ShinyHunters claims patient data theft
AI-driven vulnerability discovery is accelerating. See how Action1 helps remediation keep pace.
Discover why encryption and key management are critical for modern business.
Overdue a password health-check? Audit your Active Directory for free
Pixellot discovered and secured hundreds of unmanaged AI agent identities in weeks, not months. Download the case study for how.
Learn how ESET MDR can enhance your organization’s security posture
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
