Defender Says It Is Turned Off? It Probably Is Not

A notification tells you Microsoft Defender Antivirus is turned off, you open Windows Security, and every setting there says it is on and working.

Good news: you are not going mad and nothing is broken. Microsoft confirmed this exact thing yesterday, and the notification is the part that is wrong.

I read what antivirus protection this machine actually reports before writing, because the whole point of this page is that the notification is not the thing to trust.

What Microsoft has confirmed

One day old when you read this. Marked Confirmed, not Reported.

⭐ Microsoft states it on its release health page: notifications "might appear stating that 'Microsoft Defender Antivirus is turned off,' even though the antivirus is functioning correctly and all settings show it as active".

⚡ It names when they reach you: "These notifications can appear when Windows starts and intermittently afterward."

⚠️ And it names the trap: "They persist even if notification settings are turned off." So silencing them fails too.

⛔ The cause is a Defender update, not a Windows one. Microsoft says it follows "the latest updates for Microsoft Defender Antivirus".

Read your own state instead of the notification

One command. It answers the question the pop-up is confusing.

⚡ Open Terminal and run this. It changes nothing:

Get-MpComputerStatus | Select-Object AntivirusEnabled, RealTimeProtectionEnabled, AMServiceEnabled, AntispywareEnabled, AntivirusSignatureLastUpdated

⭐ Four Trues and a recent date is a working antivirus. That is the actual state, read from Defender itself rather than from a message.

⚠️ Windows Security is the other route. Microsoft's own wording is that all settings there show it as active.

⛔ Two sources agreeing beats one pop-up disagreeing. If both say on, you are protected.

What this machine reports

Read here, and it is exactly the pattern Microsoft describes.

⭐ All four values I read come back True. Antivirus, real time protection, the service itself and antispyware.

⚡ The signature date is today, a few hours old when I read it. Defender is not just on here, it is current.

⚠️ So the protection here is working. Any such notification on this machine would be false, which is the whole shape of the issue.

⛔ Your machine will almost certainly say the same. Run it before you spend money on anything.

How wide it goes

Wider than most known issues, and that is worth knowing.

⚡ Microsoft lists Windows 11 versions 26H1, 25H2, 24H2 and 23H2, plus the Windows 10 versions you may still be running and two Enterprise builds.

⭐ And six versions of Windows Server, going back to 2012.

⚠️ Your version is on that list whatever it is. Microsoft says the issue "can be observed in any version of Windows or Windows Server with Microsoft Defender Antivirus running with the latest Defender updates".

⛔ So it is not your machine, your build or your hardware. A list that long is a sign of something central rather than something local.

What not to do about it

Four things, and people are doing all of them this week.

⭐ Do not install a second antivirus. Two real time scanners on one machine cause genuine problems, and there is nothing here to fix.

⚡ Do not turn Defender off and on again to make the message go. You would be creating the very gap the notification is wrongly warning about.

⚠️ Do not reinstall Windows. A repair install is a serious step and this is not the reason for one.

⛔ And do not pay for a cleaner that promises to fix it. The pop-up telling you that you have a virus is its own subject.

When the notification is telling the truth

Ours, because a false alarm today does not make every alarm false.

⚡ If your command returns False on any of the four, that is real. Read that rather than assuming this issue covers you.

⭐ A third party antivirus switches Defender off deliberately. That is normal, it is by design, and one of them is enough.

⚠️ An expired third party trial is the classic trap. It stops protecting and Defender does not always come straight back.

⛔ A recent signature date is the reassuring number. If yours is weeks old, that is worth chasing whatever the notification says.

What happens next

Short, because there is nothing for you to install today.

⭐ Microsoft says a fix is coming through Defender rather than through Windows Update: it is "working to release a resolution in a future Microsoft Defender Antivirus update".

⚡ Those arrive on their own. Often more than once a day. You do not have to go looking.

⚠️ No workaround is offered, which is unusual and tells you Microsoft considers the risk cosmetic.

⛔ So the correct action is to check once and then ignore it. That is genuinely the whole answer.

Status: Defender protection state measured here on 29 August 2026, on Windows 11 Home 25H2, against Microsoft's own release health entry for this issue, opened 28 August 2026 and marked Confirmed. ⛔ Nothing was changed, no protection setting was written, and no scan result, file name or threat history is published.

Is the Microsoft Defender is turned off notification real?

Microsoft has confirmed it as a known issue. Its own wording is that the notification might appear even though the antivirus is functioning correctly and all settings show it as active. Check your own state with one command rather than trusting or dismissing the message.

How do I check if Defender is actually running?

Run Get-MpComputerStatus in Terminal and read four values: antivirus enabled, real time protection enabled, the service enabled, and antispyware enabled. Four Trues with a recent signature date means it is working. Windows Security shows the same thing in a friendlier form.

Why does turning off notifications not stop it?

Because Microsoft says these particular notifications persist even when notification settings are turned off. That is part of the confirmed issue rather than something you have set wrong, and it is one of the reasons the reports stood out.

Do I need to install another antivirus because of this?

No. Nothing is unprotected. Installing a second real time scanner alongside a working Defender causes more problems than it solves, and Microsoft says a fix is coming in a future Defender update rather than asking anyone to do anything.

The Short Version

• Microsoft confirmed the notification on 28 August 2026. It is wrong.
• Its own wording: the antivirus is functioning correctly and shows as active.
• The notifications persist even with notification settings turned off.
• One command reads the real state. Four Trues means you are protected.
• This machine returns all four True with signatures from the same day.
• The list of affected versions runs from Windows 10 21H2 to Server 2012.
• Do not add a second antivirus and do not reinstall Windows.
• A fix is coming through a Defender update, not through Windows Update.

Where to Next

Run the one line command and read the four values. That settles it in ten seconds.

If they all come back True, close the notification and get on with your day.

If any of them comes back False, that part is real, and a lapsed third party trial is the first thing to check.

Leave Defender alone in the meantime. Switching it off to silence a message is the one genuinely risky move here.

And if the notification stops for you after a Defender update lands, say which day in the comments. That would date the fix better than anything Microsoft has published.