Microsoft Defender Bug Trains Users to Ignore Warnings
Microsoft said recent Defender updates are causing Windows and Windows Server machines to show a false “Antivirus is turned off” warning even though Microsoft Defender Antivirus is still running. The issue spans current Windows 11 and Server releases back to Windows 10 Enterprise LTSC 2016 and Windows Server 2012, and Microsoft says a fix is pending.
The message can appear at startup and again later, and it can keep showing even if notification settings are changed. That matters because a warning people learn to dismiss can become the one they miss when Defender is actually disabled or tampered with, which weakens both user reporting and SOC triage.
For teams that rely on Defender alerts as a signal of endpoint health, the lasting exposure is conditioning: once this false alarm becomes familiar noise, suppression rules and help desk guidance can outlive the bug itself. The reporting does not say when the fix will land, so the operational gap is the alert trust damage, not a compromise.