Windows 11 26H1: False "Microsoft Defender Antivirus is turned off" notifications
Summary
After Microsoft Defender Antivirus update 4.18.26070.9 (released August 5, 2026), Windows and Windows Server may show notifications that Microsoft Defender Antivirus is turned off, although it works correctly. Microsoft confirmed the issue and resolved it in update 4.18.26080.4, released on September 17, 2026.
Symptoms
Notifications state that "Microsoft Defender Antivirus is turned off", although the antivirus works and all settings show it as active. They can appear when Windows starts and intermittently afterward. They persist even if notification settings are turned off.
Affected
- Client: Windows 11 versions 26H1, 25H2, 24H2, 23H2; Windows 10 versions 22H2, 21H2; Windows 10 Enterprise LTSC 2019 and 2016
- Server: Windows Server 2025, 2022, 2019, 2016, 2012 R2, 2012
- Microsoft Defender Antivirus update 4.18.26070.9
Workaround
No workaround known.
Fix
Resolved in Microsoft Defender Antivirus update 4.18.26080.4, released on September 17, 2026.
Recommendation
Make sure Microsoft Defender Antivirus is updated to version 4.18.26080.4 or later on all clients and servers. The notifications are false alarms, but verify the real protection status of a device if in doubt.
Sources
- Windows release health: Windows 11, Version 26H1 Vendor · learn.microsoft.com
- Microsoft Defender Antivirus release details Vendor · learn.microsoft.com
- Microsoft Defender updates Vendor · www.microsoft.com
- Windows release health: Windows 11, Version 25H2 Vendor · learn.microsoft.com
- Windows release health: Windows Server 2025 Vendor · learn.microsoft.com
Compiled from the sources listed and translated with AI (Claude); status and dates come from the vendor. The vendor’s statements are authoritative. Updated 1 Nov 2026, 18:19.
Where the information comes from
We continuously read the vendors’ official sources, community reports and trade media and summarise them in our own words, with a link to the source:
- Microsoft: Windows release health (Windows 10/11, Server 2016 to 2025), Windows message center, known issues of Microsoft 365 Apps (Outlook, Excel, Word, PowerPoint), Edge, Intune, Autopilot, Windows 365 and Entra Connect, Microsoft KB articles with timelines, Exchange and Windows IT Pro blogs, optionally Microsoft 365 service health and message center
- other vendors: Veeam KB, Citrix (known issues), Ubuntu and Debian (regressions), Broadcom (VMware), Fortinet, Cisco, Mozilla, Let’s Encrypt
- community (title, short excerpt and link only, without the names of the authors): Microsoft Q&A, Microsoft Tech Community (discussions), Veeam R&D Forums, Eleven Forum
- targeted web research with AI (Claude), e.g. on the updates of the month – this also finds discussions on Reddit and in forums; such entries are labelled as community reports until the vendor confirms them
- early warning from trade media (title and link only): Born’s Tech and Windows World, BleepingComputer, AskWoody, Windows Latest, Windows Central, gHacks, The Windows Club, Deskmodder, Dr. Windows, WindowsArea, Frankys Web, heise online
Summary and translation with AI (Claude by Anthropic) – without any data of visitors.
Affected? We can help.
We check whether your systems are affected, apply workarounds properly and plan for dated changes in good time.