Microsoft Defender Bug Triggers False “Antivirus Off” Alerts

Key Takeaways

• Microsoft has acknowledged a bug causing erroneous “antivirus off” alerts in Windows Security.
• The issue stems from recent Microsoft Defender Antivirus updates and affects virtually all supported Windows and Windows Server versions.
• Despite the warnings, Microsoft Defender continues to function correctly, and devices remain protected.
• A fix is currently in development, with no specific release timeline provided by Microsoft.

Microsoft Defender Bug Triggers False “Antivirus Off” Alerts Across Windows Ecosystem

Microsoft has confirmed a widespread software defect within its Defender Antivirus, leading to persistent and alarming pop-up notifications falsely claiming that antivirus protection is disabled. The tech giant assures users that this is a bug, not an actual security compromise, and that their systems remain protected.

Erroneous Alerts Stem from Recent Updates

According to an official statement from Microsoft, these misleading alerts began appearing after devices received the latest Microsoft Defender Antivirus updates. The company clarified that despite the pop-up warnings, “the antivirus is functioning correctly and all settings show it as active.”

The notifications are reported to “appear when Windows starts and intermittently afterward.” A particularly vexing aspect of this issue is that these alerts “persist even if notification settings are turned off,” preventing users from simply muting them via standard system controls.

Widespread Impact and Pending Resolution

Microsoft’s release-health advisory, initially posted on August 28, 2026, at 15:34 PT and subsequently updated, confirms the bug but notes it remains unresolved. Microsoft has stated it is “working to release a resolution in a future Microsoft Defender Antivirus update” but has not provided a specific timeline for the fix.

The scope of this bug is extensive, impacting “any version of Windows or Windows Server with Microsoft Defender Antivirus running with the latest Defender updates.” This includes a comprehensive list of operating systems:

• Windows 11 versions 23H2, 24H2, 25H2, and 26H1
• Windows 10 versions 21H2 and 22H2
• Windows 10 Enterprise LTSC 2016 and 2019
• Windows Server releases spanning 2012, 2012 R2, 2016, 2019, 2022, and 2025.

This broad reach means very few actively supported systems utilizing Microsoft Defender are exempt from experiencing these false alerts.

User Confusion Amidst Heightened Threat Landscape

The recurring false alarms have understandably caused concern among users. As reported by XDA Developers, it is “only natural to be a little bit worried” when Windows Security repeatedly indicates a lack of protection, especially “given the backdrop of accelerating, AI-fueled attacks and frequent Windows zero-day security threats.” However, the outlet reassured its readership that once Defender’s active status is verified, the only remaining concern is the nuisance of the pop-ups.

Recent History of Defender Glitches

This incident follows a separate, unrelated issue earlier in August, where some systems experienced 0xc0000005 access violation crashes during quick and full scans with Defender. Microsoft has since resolved that problem via a signature update. These consecutive events underscore how routine antivirus updates, while crucial for security, can inadvertently introduce confusing side effects that may erode user confidence, even when no genuine vulnerability is present.

What You Should Do

• Verify Defender Status: Do not simply dismiss the warning. Open the Windows Security application directly. Navigate to “Virus & threat protection.” If the dashboard indicates that real-time protection is enabled and active, your system is protected, and the alert is false.
• Ignore False Alerts: Once you have verified that Microsoft Defender is active, you can safely ignore the recurring pop-ups until Microsoft releases a fix.
• Monitor Official Channels: IT administrators should continue to monitor Microsoft’s official release-health advisories for updates on when a resolution will be deployed.
• Refrain from Disabling Defender: Do not attempt to re-enable or troubleshoot Defender based solely on the false alerts, as this could lead to actual protection being compromised.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.