Microsoft warns of phantom Defender-off notices after Defender updates
Microsoft says Windows Security may display false ‘Defender is off’ alerts after Defender antivirus updates, even though Defender remains active. The issue affects all supported Windows client and server versions, including Windows 11 26H1 and Windows Server 2025, and can appear at startup or intermittently. A fix will be released in a future Defender Antivirus update, with Microsoft noting similar post-update alert bugs have occurred previously.