Microsoft has confirmed the 'Defender is turned off' alert is wrong, and the August update was not the cause

The alert started showing up around the middle of the month: a red warning saying virus protection was turned off, on machines where Defender was quite obviously running. We wrote about it as an apparent side effect of the August update. That part was wrong, and Microsoft has now put the record straight.

On 28 August the company opened an entry on its Windows release health pages headed "Incorrect notifications that Microsoft Defender Antivirus is turned off", marked it Confirmed, and listed the originating update as N/A. No cumulative update caused this. The trigger is Defender's own updates, the small definition files that land several times a day. Microsoft's wording is unambiguous: the notifications appear "even though the antivirus is functioning correctly and all settings show it as active", they fire at startup and intermittently afterwards, and they keep firing even if you switch notifications off.

The affected list is far wider than anyone assumed in the first week. Windows 11 23H2, 24H2, 25H2 and 26H1. Windows 10 21H2 and 22H2, plus the long-term-servicing builds. Windows Server going back to 2012. In short, anything still receiving Defender updates. There is no fix yet. Microsoft says a resolution is coming in a future Defender update and has not attached a date.

So verify once, then stop thinking about it. Open Windows Security, look at Virus and threat protection, and if real-time protection reads as on, you are covered. The real risk over the next few weeks is not malware, it is the search results: a genuine, alarming Windows warning with no fix available is exactly the gap tech-support scammers set up shop in. Tendvane reads Defender's real-time-protection and firewall state from Windows directly rather than from the notification, which is a useful second opinion while the notification cannot be trusted.