--- title: Windows bug incorrectly tells users that Microsoft... description: A Microsoft Defender Antivirus update is causing Windows to falsely display notifications that Defender is turned off, even though it is running correctly,... canonical: https://daily.dev/posts/windows-bug-incorrectly-tells-users-that-microsoft-defender-antivirus-is-turned-off-1i1tfowwd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Windows bug incorrectly tells users that Microsoft Defender Antivirus is turned off | daily.dev og:description: A Microsoft Defender Antivirus update is causing Windows to falsely display notifications that Defender is turned off, even though it is running correctly,... og:url: https://daily.dev/posts/windows-bug-incorrectly-tells-users-that-microsoft-defender-antivirus-is-turned-off-1i1tfowwd og:image: https://api.daily.dev/og/posts/1i1TfowwD.png og:image:alt: Windows bug incorrectly tells users that Microsoft Defender Antivirus is turned off og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Windows bug incorrectly tells users that Microsoft Defender Antivirus is turned off **[CSO Online](https://daily.dev/sources/csoonline)** · 6 min read · 0 upvotes · 0 comments ## Summary A Microsoft Defender Antivirus update is causing Windows to falsely display notifications that Defender is turned off, even though it is running correctly, across a huge range of Windows client and server versions from Windows 10 LTSC 2016 and Server 2012 through current Windows 11 26H1. Microsoft says a fix is coming but has not given a timeline. Security experts warn the bug is dangerous because it trains users and SOCs to ignore the exact alert that typically precedes ransomware attacks, gives attackers a ready-made social engineering pretext for help desk calls, and erodes trust in security notifications generally. Consultants advise IT teams to verify Defender's actual state independently rather than telling users to ignore the alert, and to preserve telemetry evidence now in case insurers later dispute whether Defender was actually running during an incident. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why is Windows showing a notification that Microsoft Defender Antivirus is turned off when it's actually running? A known bug introduced after installing the latest Microsoft Defender Antivirus updates causes Windows to display false 'Microsoft Defender Antivirus is turned off' notifications even though the antivirus is functioning correctly and all settings show it active. These notifications appear at startup and intermittently afterward, persist even with notification settings turned off, and affect any Windows or Windows Server version running the latest Defender updates, from Windows Server 2012 through Windows 11 26H1. Microsoft has not given a fix timeline. _daily.dev helps security teams track Defender advisories like this so real alerts don't get lost in the noise._ ### Which Windows and Windows Server versions are affected by the false Defender turned off notification bug? The bug affects essentially the entire supported Windows estate, spanning Windows 11 version 26H1 and Windows Server 2025 down to Windows 10 Enterprise LTSC 2016 and Windows Server 2012, a span of about fourteen years between the oldest and newest impacted systems. Any version running Microsoft Defender Antivirus with the latest Defender updates can show the false alert, regardless of patch ring or system age. _IT teams tracking fleet-wide Windows advisories can follow updates like this on daily.dev._ ### Should IT tell users to ignore Windows Defender turned off notifications because of the known Microsoft bug? No, security experts warn against telling users to simply ignore the alert, since that trains them to dismiss the same signal that often precedes ransomware attacks. Instead, IT should communicate that Microsoft is experiencing a known notification issue while still asking users to report warnings through normal help desk channels, and should verify Defender's actual state independently rather than relying on user judgment. _daily.dev keeps security practitioners current on advisories that affect how teams should respond to alerts like this._ --- Tags: [#security](https://daily.dev/tags/security), [#windows](https://daily.dev/tags/windows), [#ransomware](https://daily.dev/tags/ransomware) [View this post on daily.dev](https://daily.dev/posts/windows-bug-incorrectly-tells-users-that-microsoft-defender-antivirus-is-turned-off-1i1tfowwd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Windows bug incorrectly tells users that Microsoft Defender Antivirus is turned off","url":"https://daily.dev/posts/windows-bug-incorrectly-tells-users-that-microsoft-defender-antivirus-is-turned-off-1i1tfowwd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/windows-bug-incorrectly-tells-users-that-microsoft-defender-antivirus-is-turned-off-1i1tfowwd"},"datePublished":"2026-08-31T20:20:16.619Z","dateModified":"2026-08-31T21:23:35.083Z","description":"A Microsoft Defender Antivirus update is causing Windows to falsely display notifications that Defender is turned off, even though it is running correctly,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/295005e8c0ff5fff9c00d5ad29b939fd?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/295005e8c0ff5fff9c00d5ad29b939fd?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/windows-bug-incorrectly-tells-users-that-microsoft-defender-antivirus-is-turned-off-1i1tfowwd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,windows,ransomware","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Windows bug incorrectly tells users that Microsoft Defender Antivirus is turned off"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/windows-bug-incorrectly-tells-users-that-microsoft-defender-antivirus-is-turned-off-1i1tfowwd#faq","mainEntity":[{"@type":"Question","name":"Why is Windows showing a notification that Microsoft Defender Antivirus is turned off when it's actually running?","acceptedAnswer":{"@type":"Answer","text":"A known bug introduced after installing the latest Microsoft Defender Antivirus updates causes Windows to display false 'Microsoft Defender Antivirus is turned off' notifications even though the antivirus is functioning correctly and all settings show it active. These notifications appear at startup and intermittently afterward, persist even with notification settings turned off, and affect any Windows or Windows Server version running the latest Defender updates, from Windows Server 2012 through Windows 11 26H1. Microsoft has not given a fix timeline. daily.dev helps security teams track Defender advisories like this so real alerts don't get lost in the noise."}},{"@type":"Question","name":"Which Windows and Windows Server versions are affected by the false Defender turned off notification bug?","acceptedAnswer":{"@type":"Answer","text":"The bug affects essentially the entire supported Windows estate, spanning Windows 11 version 26H1 and Windows Server 2025 down to Windows 10 Enterprise LTSC 2016 and Windows Server 2012, a span of about fourteen years between the oldest and newest impacted systems. Any version running Microsoft Defender Antivirus with the latest Defender updates can show the false alert, regardless of patch ring or system age. IT teams tracking fleet-wide Windows advisories can follow updates like this on daily.dev."}},{"@type":"Question","name":"Should IT tell users to ignore Windows Defender turned off notifications because of the known Microsoft bug?","acceptedAnswer":{"@type":"Answer","text":"No, security experts warn against telling users to simply ignore the alert, since that trains them to dismiss the same signal that often precedes ransomware attacks. Instead, IT should communicate that Microsoft is experiencing a known notification issue while still asking users to report warnings through normal help desk channels, and should verify Defender's actual state independently rather than relying on user judgment. daily.dev keeps security practitioners current on advisories that affect how teams should respond to alerts like this."}}]} ```