Security1 publisher2 min readPublished
Microsoft's September 17 Defender update ends the false 'antivirus is turned off' notifications
Defender Antivirus 4.18.26080.4 fixes notifications that told users the antivirus was off while it was still scanning. The bug reached every supported Windows client and server build and had been visible in Release Preview since June.
The Watch · Security desk
What happened
- Microsoft's Windows release health dashboard now says Defender Antivirus version 4.18.26080.4, released on September 17, fixes the notifications claiming the antivirus had been turned off.
- The false alerts fired in the Windows Security app at Windows startup and intermittently afterwards, and they kept appearing even when the user had notifications switched off.
- The bug reached all supported Windows client and server versions, including Windows 11 26H1 and Windows Server 2025, while Defender itself kept working and reporting itself as active.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint For three months a 'Defender is turned off' toast on those builds proved nothing, so triage had to go check the engine's actual state before treating the popup as a tamper signal.
- cost The bill was helpdesk time and user attention: tickets for an alert that ignored the mute switch, closed with an instruction to ignore it.
- precedent Five disregard-this-alert notices since April 2025 train Windows users to read security warnings as noise. A genuine tamper alert has to overcome that habit.
- decision Estates that stage Defender platform updates on a slow ring now choose between pulling 4.18.26080.4 forward and continuing to answer the tickets.
Nothing here is exploitable. Defender kept scanning while the Windows Security app said otherwise, and Microsoft said the notifications "can appear when Windows starts and intermittently afterward" and "persist even if notification settings are turned off" [7]. The prompt told the user to "Tap or click to turn on Microsoft Defender Antivirus" [5].
The release health entry Microsoft posted in late August described a false alarm over a working product: the notifications appear "even though the antivirus is functioning correctly and all settings show it as active," the company said [6][2].
Insiders on the Release Preview channel had been seeing it since at least June [3]. That is roughly two months before Microsoft acknowledged it [13] and about three months before the fix shipped on September 17 [12]. In between, the code went out to all supported Windows client and server versions, including Windows 11 26H1 and Windows Server 2025 [4].
The fix is identified by a Defender Antivirus platform version, 4.18.26080.4 [1]. It therefore arrives on Defender's own update channel, not in a monthly cumulative, and hosts that hold platform updates back keep the alert until those updates are allowed through [15].
Since April 2025 Microsoft has walked back incorrect BitLocker drive encryption errors on Windows 10 and 11 and invalid 0x80070643 failures after Windows Recovery Environment updates [8], erroneous Windows Firewall alerts that followed a reboot after the June 2025 preview update [9], and incorrect CertificateServicesClient errors from the July 2025 preview update and later Windows 11 24H2 updates [10]. With the Defender notification, that is five alerts Microsoft has asked Windows customers to disregard in that span [14][16].
The same week the Defender entry was updated, Microsoft also shipped emergency Windows updates for Remote Desktop Services, Hyper-V and USB audio problems caused by the September 2026 security updates [11].
What to watch
- Whether the October cumulative and the next Defender platform builds keep the notification suppressed, since Defender updates introduced it.
- Whether the release health entry names a minimum Defender platform version for managed estates that stage those updates on rings.
- Whether the emergency fixes for Remote Desktop Services, Hyper-V and USB audio need a second pass after the September 2026 updates.