A warning about a disconnected antivirus usually requires an immediate reaction, but after a fresh update to Microsoft Defender, such a signal may be erroneous. Microsoft confirmed the failure, because of which Windows reports on non-working protection, although the antivirus remains active and continues to perform its functions.
The problem arose after the installation of the latest Microsoft Defender updates. The notification appears when Windows is started and can then return periodically during operation. Disabling notifications in the system settings does not help, so users continue to see the warning even with properly configured and working protection.
The failure does not only affect Windows 11 25H2. False messages are possible in Windows 11 versions of 23H2, 24H2 and 26H1, multiple Windows 10 releases, and in Windows Server from version 2012 R2 to Windows Server 2025. A common condition is the installed fresh version of Defender components.
Microsoft does not associate the problem with a specific cumulative Windows update and does not name the source package. The company also did not report scan failures, threat detection or other antivirus features. Only the notification mechanism works incorrectly, and the security parameters continue to show that Microsoft Defender is enabled.
There is no ready way to remove false messages yet. Microsoft is preparing a fix for one of Defender's next updates, but does not call the release date. Before installing it, users should check the actual status of the antivirus in the Windows Security app and not disable protection due to an erroneous warning.
The problem arose after the installation of the latest Microsoft Defender updates. The notification appears when Windows is started and can then return periodically during operation. Disabling notifications in the system settings does not help, so users continue to see the warning even with properly configured and working protection.
The failure does not only affect Windows 11 25H2. False messages are possible in Windows 11 versions of 23H2, 24H2 and 26H1, multiple Windows 10 releases, and in Windows Server from version 2012 R2 to Windows Server 2025. A common condition is the installed fresh version of Defender components.
Microsoft does not associate the problem with a specific cumulative Windows update and does not name the source package. The company also did not report scan failures, threat detection or other antivirus features. Only the notification mechanism works incorrectly, and the security parameters continue to show that Microsoft Defender is enabled.
There is no ready way to remove false messages yet. Microsoft is preparing a fix for one of Defender's next updates, but does not call the release date. Before installing it, users should check the actual status of the antivirus in the Windows Security app and not disable protection due to an erroneous warning.
