Microsoft confirmed on August 28 that, in Windows 11, a notification stating that protection is turned off may appear incorrectly even when Microsoft Defender Antivirus is running. The warning may recur at startup or during use; it affects Windows 11 23H2, 24H2, 25H2 and 26H1, as well as some Windows 10 and Windows Server versions. The issue is not associated with a specific cumulative update, but it may occur on systems using up-to-date Defender updates. The notification may not reflect the actual protection status; Defender may remain enabled and continue providing protection. Users should check Real-time protection under Windows Security > Virus & threat protection > Manage settings. If the option is turned off, a different security issue should be investigated. Microsoft does not recommend installing a new antivirus; when another compatible antivirus is running, Defender is turned off and may be re-enabled when that antivirus is removed.
Why it matters
The false warning means users cannot reliably determine from the notification whether their devices are actually protected. While this increases the risk of unnecessary intervention for individuals and organizations using different Windows versions, it also makes it necessary to distinguish systems where real-time protection is turned off from those showing only an incorrect notification. Microsoft’s recommendation not to install a new antivirus indicates that the issue concerns the accuracy of the status information in the user interface rather than whether Defender is running. However, because the problem is not associated with a specific cumulative update, the conditions under which it occurs and when a permanent fix will be provided remain unclear. Therefore, users should not regard the warning alone as a definitive indicator of security.
Background
Windows is not a new name in the FikirPilot archive: we have published 4 articles mentioning this name in the last 90 days; the most recent was dated September 5, 2026.