Microsoft has resolved a known issue that causes incorrect alerts warning that Defender Antivirus was turned off after installing recent updates.
In a Windows release health dashboard update on Thursday, Microsoft said the issue was fixed in the Microsoft Defender Antivirus update (version 4.18.26080.4) released on September 17.
The company acknowledged the bug in late August, even though the issue had affected users in the Release Preview Channel of the Windows Insider program since at least June.
As Microsoft explained, this affects all supported Windows client and server versions, including the latest Windows 11 26H1 and Windows Server 2025 releases, and it triggers erroneous alerts in the Windows Security app that prompt users to “Tap or click to turn on Microsoft Defender Antivirus.”
“After installing the latest updates for Microsoft Defender Antivirus, notifications might appear stating that “Microsoft Defender Antivirus is turned off,” even though the antivirus is functioning correctly and all settings show it as active,” it said at the time.
“These notifications can appear when Windows starts and intermittently afterward. They persist even if notification settings are turned off.”
This isn’t the first time Microsoft asked customers to ignore incorrect errors and alerts displayed on their systems after installing updates.
In April 2025, the company addressed an issue that was triggering incorrect BitLocker drive encryption errors on Windows 10 and Windows 11 devices and fixed a bug that caused invalid 0x80070643 failure errors after installing the Windows Recovery Environment (WinRE) updates.
It also asked users in July 2025 to ignore erroneous Windows Firewall alerts that appeared after rebooting after installing the June 2025 preview update.
One month later, it warned that the July 2025 preview update and subsequent Windows 11 24H2 updates were causing incorrect CertificateServicesClient (CertEnroll) errors.
This week, Microsoft also released emergency Windows updates to fix Remote Desktop Services, Hyper-V, and USB audio issues caused by the September 2026 security updates.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
