Windows Defender Turned Off by Itself: How to Tell If It’s a False Alarm or Real Attack

“Microsoft Defender Antivirus is turned off” shows up in a red or yellow banner in Windows Security. It often appears right after you sign in, and it sounds like your PC has zero protection. Don’t panic yet; check whether this is real or a false alarm first.

Quick Diagnosis: Is Defender Actually Off?

Don’t trust the notification alone. Verify your real protection status first.

• Press Win + R, type powershell, and press Ctrl + Shift + Enter to open PowerShell as Administrator.
• Run this cmdlet:

Get-MpComputerStatus | Select-Object AntivirusEnabled, RealTimeProtectionEnabled, AMServiceEnabled, AntispywareEnabled

• Check the output. If AntivirusEnabled, RealTimeProtectionEnabled, and AMServiceEnabled all say True, your protection is running fine. The “turned off” notification is probably a false alarm, most likely the known Microsoft bug covered below.
• If any of these say False, move to the causes and fixes further down.

Is This the August–September 2026 Microsoft False-Alarm Bug?

Microsoft confirmed a bug in August and September 2026. It caused Windows Security to falsely report Defender as “turned off.” This happened both on startup and randomly through the day. Real-time protection kept working fine in the background the whole time. The bug hit Windows 11 23H2, 24H2, and 25H2 devices. Microsoft tracked it on its release health dashboard. Annoying, but harmless: Defender was doing its job the whole time.

Microsoft fixed it with a Defender platform update released September 17, 2026. It’s version 4.18.26080.4, also known as KB4052623. If your Get-MpComputerStatus results all show True but you still see the warning banner, you almost certainly hit this bug. It’s not a real security problem.

Fix #1: Install the Defender Platform Update

• Open Settings > Windows Update.
• Click Check for updates.

• Install any pending updates, including optional Microsoft Defender Antivirus platform updates, look for KB4052623 or a later version.
• Restart your PC.
• Reopen Windows Security and confirm the “turned off” banner is gone. If it lingers, click Refresh or restart the Security Center service (covered in Fix #4).
• To confirm the update actually landed, open Windows Security > Settings (gear icon) > About, and check that the Antimalware Client Version reads 4.18.26080.4 or higher.

If the status check in the Quick Diagnosis section came back clean, this update alone fixes it. There’s no deeper problem to chase.

Legitimate Causes: When Defender Is Actually Off (and Why)

If your PowerShell check showed False values, something is genuinely disabling Defender. Before you jump to malware, rule out these normal, non-malicious causes.

Third-party antivirus installed. Windows automatically disables Defender’s real-time scanning when it detects another antivirus program running. This keeps the two scanners from fighting each other. That’s normal Windows behavior.

Group Policy or MDM management. On Windows 10/11 Pro, Enterprise, or Education, an IT admin can disable Defender through Group Policy or mobile device management (MDM). So can a leftover policy from an old work profile. Group Policy isn’t available on Windows Home.

Tamper Protection state. Tamper Protection blocks changes to Defender settings. That includes legitimate changes you try to make yourself while it’s on. If you can’t get a toggle to stick, this is probably why.

Fix #2: Confirm and Remove a Conflicting Antivirus

• Open Settings > Apps > Installed apps.

• Look for any third-party antivirus or internet security suite (Norton, McAfee, Bitdefender, Avast, AVG, etc.).
• If you want Defender active instead, click the three-dot menu next to the program and select Uninstall.
• Restart your PC.
• Reopen Windows Security; Defender’s real-time protection should re-enable automatically within a few minutes.

If you’d rather keep the third-party tool, that’s fine too. Defender staying off, or switching to passive mode, while another antivirus is active is normal and expected.

Real Attack Indicators: When to Suspect Malware

Some malware families target antivirus software directly. They disable it to avoid detection while they operate. That’s the scary version of this problem, but it’s also the rarer one. Suspect a real attack, not a bug or setting, if you see:

• Defender turns off repeatedly with no update, install, or policy change you made
• Tamper Protection has been switched off and you didn’t do it
• Unfamiliar programs, browser toolbars, or scheduled tasks you don’t recognize
• Sudden slowdowns, pop-ups, or your browser homepage changing on its own
• You can’t reopen Windows Security, or it closes immediately after opening
• New local user accounts or firewall rules you didn’t create

If two or more of these apply, skip ahead to the Offline Scan section below after re-enabling protection.

Step-by-Step: Re-Enable Defender

Fix #3: Turn Real-Time Protection Back On in Windows Security

• Press Start, type Windows Security, and open the app.

• Click Virus & threat protection.

• Click Manage settings under Virus & threat protection settings.
• Turn on Real-time protection.

• If the toggle flips back off within a few seconds, something’s overriding it, such as a policy or registry setting. Move on to Fix #4 or Fix #5.

Fix #4: Restart the Defender and Security Center Services

• Press Win + R, type services.msc, and press Enter.
• Find Microsoft Defender Antivirus Service in the list (internal name WinDefend).

• Right-click it and select Restart. If it’s stopped, right-click and select Start instead.
• Repeat for Security Center (internal name wscsvc; some builds list it as Windows Security Center).
• Double-click each service, confirm Startup type is set to Automatic, and click OK.
• Reopen Windows Security and check the status again. Exact service names and their visibility can vary slightly by Windows edition and build, if you don’t see one listed by these exact names, search the Services list for “Defender” or “Security Center.”

Fix #5: Clear the Group Policy Block (Pro/Enterprise Only)

Group Policy only exists on Windows 10/11 Pro, Enterprise, and Education. Skip this fix on Windows Home.

• Press Win + R, type gpedit.msc, and press Enter.
• Navigate to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus.

• Double-click Turn off Microsoft Defender Antivirus.
• Set it to Not Configured (or Disabled), then click OK.
• Open Command Prompt as Administrator and run gpupdate /force to apply the change immediately.
• Restart your PC and recheck Defender’s status.

Fix #6: Delete the DisableAntiSpyware Registry Key (Advanced)

This is a legacy registry control that rogue policies and some malware still abuse. Note that on fully managed devices (work or school PCs enrolled in Intune or another MDM), Defender can also be enforced or disabled through policy channels that don’t touch this key, so clearing it won’t override those. Back up the registry before editing it, or create a restore point first.

• Press Win + R, type regedit, and press Enter.
• Navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender

• Look for a DWORD value named DisableAntiSpyware. On an unmanaged home PC, this key normally doesn’t exist at all, so finding it is a strong sign something (malware or a leftover policy) deliberately disabled Defender this way.
• If you find it and its data is set to 1, right-click it and select Delete.
• Close Registry Editor and restart your PC.
• Recheck status with Get-MpComputerStatus in PowerShell to confirm AntivirusEnabled now shows True.

Turn On and Verify Tamper Protection

Tamper Protection stops malware and unauthorized users from changing the settings you just fixed. If it’s off, that’s often how Defender got disabled in the first place.

Fix #7: Enable Tamper Protection

• Open Windows Security > Virus & threat protection > Manage settings.
• Turn on Tamper Protection.

• Confirm the toggle stays on after closing and reopening the app.
• Verify from PowerShell (read-only check, since Tamper Protection blocks direct registry edits):

Get-MpComputerStatus | Select-Object IsTamperProtected

Need to make a trusted Defender change later, say a registry edit for a legitimate reason? Turn off Tamper Protection temporarily in Manage settings, make the change, then flip it back on right away.

One more thing worth knowing: if you keep seeing the “turned off” banner but every status value in Fix #1’s PowerShell check reads True, that’s the resolved notification bug, not a reason to keep disabling and re-enabling Defender or Tamper Protection. Repeatedly toggling protection off “just to be sure” doesn’t fix a display bug and briefly leaves you unprotected for no benefit.

Run a Microsoft Defender Offline Scan

Found real attack indicators? Run a boot-time scan before doing anything else. Active malware can hide from a normal in-Windows scan.

Fix #8: Run an Offline Scan

• Save any open work; your PC will restart during this scan.
• Open Windows Security > Virus & threat protection.
• Click Scan options.

• Select Microsoft Defender Antivirus (Offline scan).
• Click Scan now.
• Your PC restarts and scans before Windows fully loads, then boots back in and shows results in Windows Security.
• If threats turn up and get removed, redo Fix #6 and Fix #7 afterward. Malware sometimes leaves registry changes behind even after it’s gone.

Error Messages Quick Reference

Message / Symptom	Likely Meaning	Fix to Try
“Microsoft Defender Antivirus is turned off” but Get-MpComputerStatus shows True	Known Aug–Sept 2026 false-alarm bug	Fix #1 (install KB4052623)
Defender off right after installing another antivirus	Expected auto-disable to prevent conflicts	Fix #2 (uninstall conflicting AV, or leave as-is)
Toggle switches back to off immediately	Group Policy or registry override	Fix #5 or Fix #6
“Some settings are managed by your organization”	Group Policy/MDM management	Fix #5, or contact your IT admin
Defender off with no clear cause + odd behavior	Possible malware tampering	Fix #7, then Fix #8
Can’t toggle Real-time protection or Tamper Protection	Tamper Protection blocking the change on purpose	Turn off Tamper Protection temporarily, then back on

When to Escalate

Contact Microsoft Support or a professional if:

• Get-MpComputerStatus still shows False values after trying Fix #3 through Fix #6
• The Offline scan finds and removes threats, but Defender turns off again within a day or two
• You see unfamiliar admin accounts, disabled firewall rules, or ransom notes, signs of compromise beyond simple tampering
• You manage a work or school PC and Group Policy is grayed out; this needs your IT administrator, not a local fix

Prevention Tips

• Keep Windows Update current: Install Defender platform updates promptly via Settings > Windows Update. Most false alarms and known bugs get patched within weeks.
• Leave Tamper Protection on: Only disable it briefly for trusted, intentional changes.
• Don’t run two real-time antivirus programs: Pick one, Defender or a third-party suite, to avoid conflicts and unexpected disabling.
• Check status periodically with PowerShell: Get-MpComputerStatus gives you ground truth faster than trusting notification banners alone.
• Consider a UPS for desktops: An unexpected power loss during a Windows or Defender update can leave settings broken. A basic UPS protects against that.

Wrapping Up

Run the PowerShell check first. If everything reads True, install the update (KB4052623) and get on with your day, it’s the bug, not an attack.

If your status check comes back False, work through Fix #2 through Fix #6 in order; the registry and Group Policy fixes clear up nearly every stubborn case. Only assume malware if you’re also seeing other red flags from the list above, then run the offline scan before touching anything else.

Step	Action	Applies To
1	Run Get-MpComputerStatus in PowerShell	Everyone
2	Install Windows Update / KB4052623	False-alarm bug
3	Uninstall conflicting antivirus	Third-party AV installed
4	Restart Defender/Security Center services	Toggle won’t stick
5	Fix Group Policy setting	Pro/Enterprise only
6	Delete DisableAntiSpyware registry key	Policy/registry block
7	Enable Tamper Protection	Everyone, after fixing
8	Run Microsoft Defender Offline scan	Suspected malware

Last updated: September 21, 2026 | Applies to Microsoft Defender Antivirus on Windows 10 and Windows 11