Microsoft Fixes False “Defender Antivirus Is Turned Off” Alerts

Microsoft has resolved a Defender bug that could make Windows report “Microsoft Defender Antivirus is turned off” even while Defender was still functioning and its settings showed protection as active. The fix is included in Microsoft Defender Antivirus update version 4.18.26080.4, released on September 17, 2026.

Microsoft opened the known issue on August 28 and marked it resolved on September 17. The false notification could appear at Windows startup and return intermittently afterward. Microsoft also documented that the warning could persist even when notification settings were disabled, making it more than a one-time cosmetic popup for affected users.

This was not limited to Windows 11 26H1 or to one September cumulative update. Microsoft says the issue could be observed on any Windows or Windows Server version running Microsoft Defender Antivirus with the affected Defender updates.

The affected-platform list includes Windows 11 versions 26H1, 25H2, 24H2 and 23H2, Windows 10 22H2 and 21H2 plus supported LTSC releases, and Windows Server versions from Server 2012 through Server 2025. That broad scope is important because the faulty notification came from the Defender update path rather than a single Windows feature-update branch.

A false antivirus warning does not reduce protection in the specific scenario Microsoft documented, but it creates a trust problem in an interface that is supposed to tell users when protection really is disabled. Repeated incorrect warnings can encourage people to ignore later security notifications, while the wording can also push an affected user into unnecessary troubleshooting when Defender is already running normally.

The practical dividing line is therefore the Defender engine state, not the notification alone. On a system matching Microsoft’s known issue, updating Defender to version 4.18.26080.4 or later is the documented resolution. The existence of this fix should not be treated as evidence that a genuinely disabled antivirus service is safe to ignore.

Microsoft has been correcting several unrelated September Windows regressions, including Remote Desktop, Hyper-V/Plan9 sharing and USB Audio problems through out-of-band cumulative updates. The Defender notification fix is a separate servicing path: Microsoft identifies the resolution as a Microsoft Defender Antivirus update rather than one of those Windows cumulative patches.

That distinction matters when checking whether a machine has the relevant fix. Installing a Windows out-of-band package for another September regression is not the same thing as confirming that Defender itself has reached version 4.18.26080.4 or later.