Microsoft Flags Defender Bug Across 14 Years of Windows, Falsely Saying Antivirus Is Off
Updated
Updated · Computerworld · Aug 31
Microsoft Flags Defender Bug Across 14 Years of Windows, Falsely Saying Antivirus Is Off
3 articles · Updated · Computerworld · Aug 31
Summary
Microsoft said the latest Defender updates can trigger repeated Windows alerts claiming Microsoft Defender Antivirus is turned off even though it remains active, affecting systems from Windows 11 26H1 and Server 2025 to Windows Server 2012.
The false warnings can appear at startup and intermittently afterward, persist even when notifications are disabled, and Microsoft said it is working on a fix in a future Defender update without giving a timeline.
Security experts warned the advisory could train users and SOC teams to ignore one of the clearest ransomware precursors, noting TrendMicro research found about 67% of analyzed attacks involved tampering with or disabling security software.
Consultants urged IT teams to verify Defender status through telemetry rather than tell users to dismiss alerts, and to preserve time-stamped records in case future breach or insurance disputes hinge on proving protection was actually running.