- Microsoft is asking users to ignore a false alert saying Windows Defender is turned off.
- The bug has affected test users since June, but Microsoft only flagged it this week.
- The problem hits every supported version of Windows, including Windows 11 26H1 and Windows Server 2025.
Windows users are getting a scary pop-up this week. It says their antivirus tool is off. Microsoft says the message is wrong. The company wants people to ignore the alert for now, at least until a real fix arrives.
A Fake Warning Pops Up in Windows Security
This week, Microsoft asked customers to ignore a strange alert. The alert appears after people install the newest Microsoft Defender Antivirus updates. It tells users that Defender Antivirus is turned off. In reality, the tool keeps running fine the whole time.
The issue first showed up among testers in the Windows Insider program’s Release Preview Channel. According to Microsoft’s release health dashboard, this problem has existed since June this year. Microsoft did not seem to catch the bug until now, months after it first began.
Some Windows Insiders spotted the fake warning much earlier than Microsoft did. Members on Reddit’s r/windowsinsiders posted about a “virus protection is turned off” message showing up on their screens. Users on r/antivirus shared similar complaints too, describing the same odd pop-up. The message tells people to tap or click to turn Defender Antivirus back on. But there is nothing to actually turn on, since the tool never stopped working.
This bug is not small or limited to a few machines. It touches every supported version of Windows. That list includes the newest Windows 11 26H1 release. It also includes Windows Server 2025, which many businesses rely on. Millions of devices could show the same false alarm at some point.
Microsoft Explains the Glitch, Again
Microsoft addressed the issue in a Friday update to its release health page. According to the company, the false alerts can show up right after a Defender update installs on a device. The tool works normally the whole time. Every setting still shows protection as active and running.
Microsoft also explained when the alert tends to appear on a machine. Per the company’s notes, the warning can pop up when Windows starts. It can also return every so often afterward, without any clear pattern. Turning off notifications does not solve the problem either. The alert keeps showing up regardless of that setting, which frustrates many users.
For now, Microsoft has not shipped a fix for this bug. The company says a future Defender Antivirus update will resolve it. No release date has been shared yet, so users may see the alert for a while longer.
This is not the first time Microsoft has asked users to shrug off a bad alert. The company has a clear pattern of this happening. In April, Microsoft fixed a bug that showed invalid 0x80070643 errors on some devices. Those errors appeared after users installed the April 2025 Windows Recovery Environment update. Around the same time, the company fixed wrong BitLocker encryption warnings on Windows 10 and Windows 11 machines too.
The pattern continued through the middle of 2025 as well. In July, Microsoft told users to ignore bad Windows Firewall alerts appearing on their screens. Those alerts showed up after a reboot, following the June 2025 preview update. A month later, Microsoft flagged incorrect CertificateServicesClient errors affecting other devices. Those errors came from the July 2025 preview update and later Windows 11 24H2 updates.
What this Means for Everyday Windows Users
If your computer flashes this warning, try to stay calm. Your antivirus is likely still working fine behind the scenes. Check your Defender settings if you feel unsure about your protection. The Windows Security app should still show protection as active.
Avoid disabling any real security features because of this glitch. Turning off actual protection would leave your device exposed to threats. Instead, treat the notification as noise for now. Wait for Microsoft’s promised update to arrive before doing anything drastic.
Businesses running Windows Server 2025 should tell their IT teams about this bug right away. A wave of false alerts could confuse support staff during a busy week. It may also bury a real security issue under a pile of fake ones. Teams should document the known bug internally for reference.
Regular users can keep working as usual without much worry. Nothing about your actual protection has changed because of this. Only the notification is broken, not the antivirus tool itself. Still, keep an eye on Microsoft’s release health page for future updates.
Microsoft’s track record shows that these fixes do arrive eventually. Past bugs, like the WinRE and BitLocker errors, both got resolved over time. The Firewall and CertEnroll issues followed that same pattern too. This new Defender bug will likely follow that same path as well.
Until then, one thing stays true for every Windows user. Do not panic when you see the alert on your screen. Your device is not defenseless, it is simply the message that is wrong.
WhatsApp has taken a different approach to user safety by introducing Scam Alert, an optional feature that uses an on-device AI model to flag suspicious messages from unknown contacts. The system processes everything locally; no message content leaves the user’s device, and gives people the final say on whether to block, report, or trust a flagged sender.
Share this article
About the Author
Farwa is an experienced InfoSec writer and cybersecurity journalist skilled in writing articles related to cybersecurity, AI, DevOps, Big Data, Cloud security, VPNs, IAM, and Cloud Computing. Also a contributor on Tripwire.com, Infosecurity Magazine, Security Boulevard, DevOps.com, and CPO Magazine.
More from Farwa SajjadRelated Posts
Signal Fixes Critical SGX Flaws that Could Expose Contact Discovery Data
V12 found two flaws in Signal’s Contact Discovery Service that could break the security boundary aro...
Ring Unveils TAKE Encryption to Strengthen Privacy for Home Camera Users
Ring will make its new TAKE encryption the default as the feature rolls out from September. TAKE giv...
Apple Reverses Plan to Change Hide My Email Domain After Privacy Concerns
Apple will not move Hide My Email addresses to a new domain. The company reversed a plan it announce...
Amazon and Twitch Face Class Action Over Alleged AI Training on Creator Videos
Streamer Warren Pandiscia filed a class-action lawsuit accusing Amazon and Twitch of using creator v...
768 Leaked AWS Keys Still Work, Including 526 With Root Access
Truffle Security dug out 768 leaked AWS functioning keys, including 526 root keys. Amazon’s sa...
Uber Fined Over $960 Million by Dutch Regulator Over Automated Driver Suspensions
The Dutch Data Protection Authority fined Uber €825 million, close to $966 million, for how it suspe...
