Microsoft has confirmed that a bug in a recent Microsoft Defender Antivirus update is causing Windows PCs to display alarming "Microsoft Defender Antivirus is turned off" pop-ups — even when the antivirus is running normally. The false alerts began appearing on August 28, 2026, affect every supported version of Windows and Windows Server, and there is no fix yet.

What's happening

Microsoft has confirmed that a wave of alarming Windows Security pop-ups telling users their antivirus protection is disabled is nothing more than a software bug, not an actual security issue. The warning appears in the Windows Security app and tells you to click to "turn on" Microsoft Defender Antivirus, even though the software is still actively protecting your computer.

Although this issue has been affecting users in the Release Preview Channel of the Windows Insider program since June, it appears Microsoft didn't notice it until now. Microsoft opened an official advisory on August 28 and marked the issue as confirmed but unresolved.

Which computers are affected

The known issue affects all supported Windows client and server versions, including the latest Windows 11 26H1 and Windows Server 2025 releases. That includes Windows 10, Windows 11 (23H2, 24H2, and 25H2), and Windows Server 2022/2025 machines that have installed the latest Defender antivirus definition updates.

These notifications can appear when Windows starts and intermittently afterward. They persist even if notification settings are turned off. In other words, you can't just dismiss them permanently — they'll keep coming back until Microsoft ships a real fix.

How to check if you're really protected

Because the pop-ups look identical to a genuine security failure, security professionals warn against simply ignoring them. The recommended approach is to open the Windows Security app directly and confirm that there are no genuine alerts under Virus & Threat Protection; if the dashboard shows real-time protection enabled, the notification can be safely ignored until Microsoft ships a fix.

To verify manually:

1. Click Start and type "Windows Security," then open the app. 2. Click "Virus & threat protection." 3. Under "Virus & threat protection settings," confirm that Real-time protection is set to On. 4. Run a Quick scan to confirm scanning works normally.

If all four check out, the pop-up is the known bug. If any of them show a genuine problem — real-time protection stuck off, scans failing, or unexpected threats — that is a different issue and you should have it looked at. A shop that handles malware and spyware cleanup can tell the difference between a false alert and a real infection in a few minutes.

Why this matters

The company has classified this condition as confirmed and is preparing a fix to be delivered through a future Microsoft Defender Antivirus update. It could complicate workflows that rely on user reports, screenshots, or desktop notifications as early indicators of potential control failures. For home users, the bigger risk is behavioral: people who see the alert and panic may click links in phishing emails offering "antivirus fixes," install rogue security tools, or pay for software they don't need.

A false "antivirus off" pop-up is exactly the kind of message scammers imitate in tech-support scam pop-ups. If clicking the alert opens a browser window with a phone number, that's not Microsoft — that's a scam, and it's a common reason PCs end up in a local repair shop with junkware or remote-access tools installed.

What to do until Microsoft ships a fix

Microsoft is aware of the problem and is working on a fix expected in an upcoming update, so users should not panic. In the meantime:

- Do not uninstall or reinstall Defender. No attempt to reinstall or manually reset Defender is normally required. - Do not click phone numbers or "fix it now" buttons inside browser pop-ups claiming to be from Microsoft. - Keep Windows Update turned on so you receive the eventual Defender fix automatically. - If you also run a third-party antivirus, check that it hasn't disabled Defender on purpose — that's normal behavior, not the bug.

What This Means for York, PA

York-area customers have been walking in this week worried their antivirus quit working — in almost every case it's this Microsoft bug, not a real infection. If the alert won't go away or you're not sure whether your PC is actually protected, York Computer Repair can verify Defender's status and rule out a genuine malware problem while you wait.

Microsoft Confirms Fake "Defender Is Turned Off" Alerts on Windows 10, 11, and Server