Windows 11 False Virus Alerts Are Annoying (and Potentially Dangerous)
A new Defender update is causing fake security warnings. Here's what to check before you panic.
If Windows 11 just popped up a message saying your virus protection is turned off, don’t close it in a hurry.
Microsoft has confirmed the alert is a false alarm—but it’s still worth double-checking your actual security status before dismissing it.
What’s happening
Starting in early August, users began reporting “Turn on virus protection” notifications that appear even though Microsoft Defender is running normally. The message says Defender is disabled and urges you to click to turn it back on.
The problem affects all current Windows versions—including 23H2, 24H2, 25H2, and even Windows 10—because the faulty update ships with Defender itself, not the operating system.
Microsoft’s official statement confirms the issue: “After installing the latest updates for Microsoft Defender Antivirus, notifications might appear stating that ‘Microsoft Defender Antivirus is turned off,’ even though the antivirus is functioning correctly and all settings show it as active.”
The company says it’s working on a fix but hasn’t released one yet.
Why you shouldn’t ignore it completely
False security warnings are more than just annoying. Malware often mimics legitimate alerts to trick users into disabling real protection or installing fake “security” software.
I’ve seen clients click these pop-ups daily for weeks, thinking they were fixing something. They weren’t. The alert bypasses Windows’ notification settings, so turning off “Do Not Disturb” won’t help.
Verify your actual Defender status
Run these two commands in Command Prompt or PowerShell (no admin rights needed):
sc query WinDefendIf Defender is running, you’ll see STATE : 4 RUNNING.
For a full status check, use PowerShell:
Get-MpComputerStatus | Select-Object AntivirusEnabled,RealTimeProtectionEnabled,AMServiceEnabledA healthy system shows True for all three values.
What to do right now
- Check Defender status using the commands above. If it’s active, ignore the pop-up.
- Don’t click “Turn on virus protection”—it just takes you to the same screen with no change.
- Keep an eye out for Microsoft’s upcoming Defender update, which should resolve the issue.
The bottom line
This is a known bug, not a security breach. But because attackers love to abuse fake security alerts, taking two minutes to verify your actual Defender status saves you from second-guessing later.
Microsoft will fix this in an upcoming Defender update. Until then, the best defense is knowing your system’s real status.