- Status: Confirmed by Microsoft and being investigated, but no fix is ready yet.
- Affected versions: Windows 11 23H2, 24H2, and 25H2, Windows 10, and Windows Server — all tied to a Microsoft Defender Antivirus update.
- KB / error code: No specific version number listed by Microsoft. The false alerts come from the latest Defender update; Windows 7 is spared because Defender updates are no longer shipped for it.
If you’ve been hit by Windows Defender false alerts — a Windows 11 pop-up demanding that you turn on virus protection — take a deep breath. According to Microsoft, it’s a mistake, but the company doesn’t have a fix ready yet.
What exactly are Windows Defender false alerts?
For a while now, Windows Latest has been testing a strange glitch in the Windows Security app — the hub that manages Microsoft Defender Antivirus. Randomly, it throws up a “Turn on virus protection” pop-up, either right after you boot your PC or while you’re casually browsing.
The alert claims virus protection is turned off and that you need to tap it to re-enable Defender. In practice, though, the protection was never actually switched off. Clicking the notification just sends you to the Home tab of Windows Security, where all settings still show Defender as active.
Which Windows versions are affected?
Here’s the part that makes this wider than a routine bug. The glitch isn’t tied to a single build — it’s connected to a Microsoft Defender Antivirus update, so it can hit any version running Defender.
According to Windows Latest’s testing, it’s affecting Windows 11 23H2, 24H2, and 25H2, as well as Windows 10 and Windows Server. Microsoft’s own support document confirms the same thing, noting that any version of Windows or Windows Server is affected as long as Defender isn’t actually paused.
There’s one notable exception: Windows 7. Because Microsoft no longer releases Defender updates for the older OS, it sidesteps this particular annoyance entirely.
Why this is more than a simple mistake
It’s easy to brush this off as a harmless error, but false Windows security alerts deserve a closer look. The reason is that malware has used nearly the same trick before — fake or misleading security warnings designed to spook users into disabling Defender or loosening other settings.
So when the real Windows Security app itself starts firing these alerts, it creates confusion at exactly the moment someone could exploit it. That’s why you shouldn’t just dismiss the pop-up and assume it’s a false alarm.
How to verify Windows Defender is actually running
The safest move is to check Defender yourself, rather than trusting the alert. Open Windows Security and select Virus & threat protection. If Defender is working correctly, you won’t see any real alerts there.
From there, click Manage settings under Virus & threat protection, and confirm that Real-time protection is turned on. (You can also safely ignore the OneDrive upsell prompts that sometimes ride along with these alerts — they’re not the real threat.)
If you want to verify it from the Command Prompt, run this command:
sc query WinDefend
If Microsoft Defender Antivirus is running, you should see this output:
STATE : 4 RUNNING
But that only checks one service. To confirm that Defender and its real-time protection are genuinely enabled, run this PowerShell command instead:
powershell -command "Get-MpComputerStatus | Select-Object AntivirusEnabled,RealTimeProtectionEnabled,AMServiceEnabled"
On a normally protected machine, the output should show all three values as True — AntivirusEnabled, RealTimeProtectionEnabled, and AMServiceEnabled. You can run these commands without launching Terminal as admin.
What this means for you
For most users, the takeaway is straightforward: if you’re seeing the “Turn on virus protection” pop-up, your Defender is almost certainly still running. Don’t let the alert rattle you into thinking your PC is suddenly exposed.
The real downside is the noise. If an alert is sitting in your Notification Center, you’ll keep getting more of them until Microsoft ships a fix — and the glitch even bypasses your system-wide Notifications settings and Do Not Disturb, so silencing them won’t help.
How to get the fix
Microsoft says it’s working to release a resolution in a future Microsoft Defender Antivirus update, and promises to provide more information when it’s available. Until then, there’s no manual toggle to stop the false pop-ups.
So for now, your best defense is to verify Defender manually whenever you see an alert, and keep an eye on the Windows 11 25H2 release-health status page for official updates. Once the fix lands, these false alarms should stop for good.
Source: Windows Latest
Build details:
- kb5120998
Over to you: Have you seen the ‘Turn on virus protection’ pop-up on your machine, or is your Defender still quietly ignoring it so far?
