Microsoft is telling customers to disregard notifications claiming that Microsoft Defender Antivirus has been turned off, after confirming the alerts are false and caused by a bug in recent Defender updates.

The erroneous warnings show up in the Windows Security app and urge users to “Tap or click to turn on Microsoft Defender Antivirus,” even though the antivirus is running normally and all settings indicate it is active. According to Microsoft’s release health dashboard, the notifications can appear at Windows startup and intermittently afterward, and they persist even when notification settings have been disabled.

The issue affects all currently supported Windows client and server versions, including Windows 11 26H1 and Windows Server 2025. Microsoft noted that the problem has actually been present in the Windows Insider program’s Release Preview Channel since June, but the company did not flag it as a known issue until this past Friday.

Microsoft says it is developing a fix that will roll out in a future Microsoft Defender Antivirus update, though no release date has been provided. In the meantime, affected users can safely ignore the false shutdown warnings, since underlying protection is not actually impacted.

Part of a Recurring Pattern

This is not the first time Microsoft has asked customers to disregard incorrect system alerts introduced by its own updates. Earlier incidents include:

  • Invalid 0x80070643 failure errors following April 2025 Windows Recovery Environment (WinRE) updates
  • False BitLocker drive encryption errors affecting Windows 10 and Windows 11 devices
  • Erroneous Windows Firewall alerts appearing after reboots tied to the June 2025 preview update
  • Incorrect CertificateServicesClient (CertEnroll) errors traced to the July 2025 preview update and subsequent Windows 11 24H2 updates

While none of these bugs indicate an actual security gap, they underscore ongoing quality control issues in Microsoft’s update pipeline for security-related components. Organizations relying on Defender status indicators for compliance or monitoring dashboards should be aware that the “antivirus turned off” flag may be a false positive until Microsoft ships the corrective update.