Defender says antivirus is turned off? Verify protection first

Start with the exact warning

Save the wording and when it appears. Microsoft's confirmed issue can show up when Windows starts and return intermittently later. Microsoft also says the notification can persist even when notification settings are off. That makes silencing notifications a poor test: it neither proves Defender is running nor fixes the status mismatch.

Also record the Windows edition, version, OS build, and the most recent Defender update time. Note whether the computer belongs to work or school and whether another antivirus product is intentionally installed. Those details decide which branch is safe.

Check which antivirus provider is active

Open Windows Security, choose Virus & threat protection, then open Manage providers under “Who's protecting me?” Microsoft documents this as the place to see the antivirus product registered with Windows.

• Microsoft Defender Antivirus is active. Continue to the read-only status check below.
• Another approved antivirus is active. Defender may be passive or off by design. Do not remove that product just to change the Defender message.
• The provider page says Defender is off, but the rest of Windows Security looks active. Record the disagreement and continue to the status check. A conflicting card is part of the evidence, not permission to reset security.
• No antivirus provider is active. Leave the false-notification branch. Avoid untrusted downloads and sensitive browsing, and use Microsoft Support or your administrator's approved recovery path.

Read Defender's status without changing it

Open Windows PowerShell and run this read-only command:

Get-MpComputerStatus | Select-Object `
  AMRunningMode, `
  AMProductVersion, `
  AMServiceEnabled, `
  AntivirusEnabled, `
  RealTimeProtectionEnabled, `
  AntivirusSignatureVersion, `
  AntivirusSignatureLastUpdated

Microsoft's Defender documentation says AMRunningMode set to Normal means Defender is running in active mode. AMProductVersion reports the installed platform version. The other fields tell you whether the service, antivirus engine, and real-time protection report as enabled. The signature fields show which security intelligence is installed and when it was updated.

This command does not turn protection on or off. Save the result privately. Before sending it to anyone, remove usernames, device names, organization details, paths, policy names, and other information that identifies you or the computer.

Match the result to the right branch

The current false-warning branch is a strong match when the message wording and timing fit Microsoft's notice, Defender is the intended provider, AMRunningMode is Normal, and the service, antivirus, and real-time fields are True. Keep the protections enabled. Record the discrepancy and the current Defender update information.

An authorized third-party or managed branch applies when another product is the active provider, Defender is in an expected non-active mode, or organization policy controls the security state. Let the product owner or administrator handle it. A home-computer fix can break an approved workplace configuration.

A real inactive-protection branch applies when no authorized provider explains the state and the service, antivirus, or real-time protection fields are genuinely inactive. Do not label that as Microsoft's harmless notification issue. Use Microsoft's Defender service-startup guidance, the Get Help app, Microsoft Support, or your administrator.

Install only the supported updates offered to this PC

Windows normally keeps Defender security intelligence current. You can check through Windows Security > Virus & threat protection > Protection updates or through Windows Update. Save active work first, install only the current update offered to the device, restart when requested, and repeat the same provider and status checks.

Microsoft says platform version 4.18.26080.4 resolved this notification on September 17. After the supported update and restart, read AMProductVersion again and repeat the provider and protection checks. The platform version is separate from AntivirusSignatureVersion, so a newer signature number alone does not prove that the notification fix is installed. If the warning returns on the fixed or a later platform version while protection remains active, preserve the result for Microsoft Support or the responsible administrator instead of cycling through resets.

Do not borrow the fix from the Defender scan-crash issue

This notification is not the same problem as a Quick Scan or Full Scan that crashes with 0xc0000005 or stops the Threat service. That separate incident has its own released security-intelligence baseline and its own article. If the scan itself crashes, use the Defender scan-crash guide.

The notification fix is Defender platform version 4.18.26080.4. The scan-crash article uses a different security-intelligence version for a different incident. Keep the two version checks separate so a scan-crash fix does not hide a genuinely inactive antivirus state.

Should you run a scan?

If Defender is active and the computer is otherwise stable, one Quick Scan can show that the engine responds. It is optional, and it is not proof that the PC is free of threats. Do not run repeated scans to make the notification disappear.

If a scan fails, the provider changes unexpectedly, the service stops, a threat appears, or other security warnings start at the same time, save that new result. The problem has moved beyond a notification-only mismatch.

Build a small support record

• the exact notification and when it appears
• Windows edition, version, and OS build
• the active provider shown in Windows Security
• the six read-only Defender fields above
• the latest Defender update time and version
• whether another antivirus is installed
• whether work, school, or family management controls the PC
• the result after one supported update and restart

If broader Windows notifications are missing rather than this exact security warning appearing, use the Windows notification-delivery guide. If Windows Update itself is stuck or fails, keep that error separate and use the Windows Update diagnostic.

Where OmniMend fits

On a supported Windows PC, OmniMend can help organize the message, Windows build, update timing, process state, and related event clues into a clearer support record. It is not an antivirus. It does not enable Defender, remove malware, change security policy, install Defender updates, silence notifications, or certify that a computer is clean.

Use Windows Security and Microsoft for the security decision. If you want help keeping the before-and-after details together, review what OmniMend can inspect and share only a redacted record with the right support team.