Microsoft Defender Antivirus Is Turned Off Even Though It Is Running – How to Verify Your Protection
If Windows displays the "Microsoft Defender Antivirus is turned off" notification even though Defender appears to be active, your computer may be affected by a known Microsoft Defender issue. However, you should verify Defender’s status before dismissing the warning.
Microsoft confirmed on August 28, 2026, that recent updates to Microsoft Defender Antivirus may cause Windows to incorrectly report that "Defender is turned off" while the antivirus remains enabled and working properly.
According to Microsoft, the issue can occur on any version of Windows or Windows Server running Microsoft Defender Antivirus with the latest Defender updates.
How to Verify Your Protection When Microsoft Defender Says "Antivirus Is Turned Off" Even Though It Is Running
In this guide, you will learn how to verify that Microsoft Defender is running correctly and determine whether the warning on your computer is related to the issue reported by Microsoft.
* Note: The following instructions apply only when Microsoft Defender Antivirus is the primary antivirus solution on your computer. When a compatible third-party antivirus product is installed and registered as the primary security provider, Microsoft Defender Antivirus may automatically enter passive mode or become disabled. In that case, the results shown below may be different.
Step 1. Check Whether Microsoft Defender Is Active.
The quickest way to determine whether Defender is really active is to check its status with PowerShell instead of relying only on the Windows Security notification.
1. Open Windows PowerShell as Administrator.
2. Type the following command and press Enter:
Get-MpComputerStatus | Select-Object AMRunningMode, AntivirusEnabled, AMServiceEnabled, RealTimeProtectionEnabled
3. If Microsoft Defender is active and working normally, you should see:
AMRunningMode : Normal AntivirusEnabled : True AMServiceEnabled : True RealTimeProtectionEnabled : True
4. If these values indicate that Defender is active while Windows continues to display the "Microsoft Defender Antivirus is turned off" warning, your computer is likely affected by the false notification issue confirmed by Microsoft.
If PowerShell reports that Defender is active, you can perform some additional steps to make sure your virus protection is working.
Step 2. Verify That the Microsoft Defender Service Is Running.
1. In the same PowerShell window, run the following command to ensure that the Microsoft Defender Antivirus service is active:
Get-Service WinDefend
2. On a computer where Microsoft Defender is active, Status should normally show: Running
Step 3. Verify That Microsoft Defender Can Update.
1. In the same PowerShell window, run the following command to force Microsoft Defender to download and install the latest antimalware definitions:
Update-MpSignature
2. Then, check the currently installed signature version and its last update time by running the following command:
Get-MpComputerStatus | Select-Object AntivirusSignatureVersion, AntivirusSignatureLastUpdated
3. If the Update-MpSignature command completes without an error, Microsoft Defender was able to check for and install any available security intelligence updates. The AntivirusSignatureLastUpdated value shows when the currently installed antivirus definitions were last updated. If the latest definitions were already installed, the displayed date and time may not change.
Step 4. Run a Quick Scan.
As a final functional check, start a Microsoft Defender quick scan. To run a Quick Scan, issue the following command in PowerShell as Admin:
Start-MpScan -ScanType QuickScan
Alternatively, open Windows Security > Virus & threat protection, and then click Quick scan.
Conclusion
If Microsoft Defender is the primary antivirus, the status checks confirm that it is running in active mode, real-time protection is enabled, signatures can be updated, and a quick scan completes successfully, the notification is most likely related to the known issue confirmed by Microsoft on August 28, 2026. No attempt to reinstall or manually reset Defender is normally required. You may dismiss the notification while waiting for Microsoft to release the corrective Defender update.
If any of the status values are False, the WinDefend service is not running, signature updates fail, or a quick scan cannot start or complete, do not assume that the warning is false. Troubleshoot Microsoft Defender or contact your system administrator.
Frequently Asked Questions
Why am I seeing the 'Microsoft Defender Antivirus is turned off' notification?
You might be experiencing a known issue with Microsoft Defender where Windows incorrectly reports that Defender is turned off, even though it remains active and functioning properly.
How can I verify if Microsoft Defender is actually active?
You can verify if Microsoft Defender is active by opening Windows PowerShell as Administrator and running specific commands to check its status, such as 'Get-MpComputerStatus' which shows details about Defender's running mode and status.
What should I do if PowerShell indicates Defender is active but the notification persists?
If PowerShell confirms that Defender is active while Windows continues to display the warning, your computer is likely affected by the false notification issue confirmed by Microsoft. You can further ensure the service is running and able to update by following additional verification steps outlined in the guide.
How can I ensure that Microsoft Defender is fully operational?
To ensure Microsoft Defender is operational, verify that its service is running, confirm it can update by using 'Update-MpSignature', and perform a quick scan to check functionality.
- Microsoft Defender Antivirus Is Turned Off Even Though It Is Running – How to Verify Your Protection - August 31, 2026
- Fix Game Crashes and Unexpected PC Restarts on Windows 11. - August 28, 2026
- FIX: Your organization has deleted the device – 700003 - August 27, 2026
