Windows Says Virus Protection Is Off. Microsoft Says It Is Not.

Your PC keeps telling you virus protection is switched off, and Microsoft has now confirmed the warning is simply wrong.

Since early August, Windows Security has been throwing up a "Turn on virus protection" pop-up saying Microsoft Defender Antivirus is off.

It is not off.

Microsoft has confirmed the alert is a bug in a recent Defender update, and it has no fix ready.

What Is Actually Going On

This is the alert, word for word: "Virus protection is turned off. Tap or click to turn on Microsoft Defender Antivirus."

In its Windows release health notes, Microsoft says notifications may claim Defender is turned off "even though the antivirus is functioning correctly and all settings show it as active".

The company opened the entry on 28 August and it still reads Confirmed, with no patch date attached. The fix is promised in a future Defender update, which is as specific as Microsoft has been willing to get.

Because the fault sits in Defender rather than in Windows itself, it reaches almost everything - Windows 11 23H2, 24H2, 25H2 and 26H1, Windows 10, and Windows Server going back to 2012. Anything running current Defender definitions can see it.

Two details make it more irritating than the average bug. The alert reappears after you dismiss it, and it ignores your notification settings entirely, so Do Not Disturb will not silence it.

How to Check Defender Is Really Running

Do not simply assume the alert is the known bug. Spend twenty seconds confirming it, because the one thing worse than a false alarm is a real one you waved away.

1. Open Windows Security from the Start menu and select Virus & threat protection.
2. Click Manage settings and confirm Real-time protection is switched on.
3. For a second opinion, open Command Prompt and run sc query WinDefend - a healthy machine reports STATE : 4 RUNNING.

This is what a machine showing the false alert looks like underneath - real-time protection, cloud-delivered protection and tamper protection all reading On.

Note the "Windows 10 device" wording in the sidebar, a reminder that this is not a Windows 11 problem.

If you want the complete picture in one line, run this in Command Prompt or Terminal. No administrator rights needed.

powershell -command "Get-MpComputerStatus | Select-Object AntivirusEnabled,RealTimeProtectionEnabled,AMServiceEnabled"

Three lines come back. If all three say True, Defender and its real-time protection are active and you can ignore the pop-up until Microsoft patches it.

Why This Bug Is Worse Than It Looks

So treat the habit as the risk, not the pop-up. Verify with the steps above, then leave the alert alone rather than hunting for a third-party tool to make it stop.

If you would rather layer something on top of Defender while this plays out, our free antivirus and privacy tools are a safer starting point than whatever a search result recommends.

It has been a noisy few weeks for Windows generally, between Copilot helping itself to 3.3 GB of Windows 10 drives and the new opt out of backup button for OneDrive.

Quick questions

The scale of the bug was first documented by Windows Latest, whose testing pushed Microsoft into confirming it.

A wrong warning is still worth checking, and now you know how in twenty seconds.

Browse our free antivirus and privacy tools if you want something alongside Defender, or leave a comment telling us whether the alert has hit your machine.