Brief "Defender turned off" notification — logs show a normal service restart, is this expected?

Question

Brief "Defender turned off" notification — logs show a normal service restart, is this expected?

Vlad Vlad 20

Hi everyone,

I briefly saw a push notification saying Microsoft Defender was turned off. I opened Windows Security right after and Defender was on and working normally.

I checked Event Viewer (Applications and Services Logs → Microsoft → Windows → Windows Defender → Operational) and found this sequence of events around the same time:

HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates: 0x1 → 0x0 HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress: PostPlatformUpdate → LoadingEngine → ServiceStartedSuccessfully HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates: 0x0 → 0x1 HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\ToastOrSsoTrigger: 0x0 → 0x1

0 comments

2 answers

Your answer

Answer 1

This is a known issue and Microsoft is working on a fix.

See Windows 11, version 25H2 known issues and notifications | Microsoft Learn

Incorrect notifications that "Microsoft Defender Antivirus is turned off"

Status Originating update History

Confirmed N/A

Last updated: 2026-08-28, 16:02 PT

Opened: 2026-08-28, 15:34 PT

After installing the latest updates for Microsoft Defender Antivirus, notifications might appear stating that "Microsoft Defender Antivirus is turned off," even though the antivirus is functioning correctly and all settings show it as active. These notifications can appear when Windows starts and intermittently afterward. They persist even if notification settings are turned off.

This issue can be observed in any version of Windows or Windows Server with Microsoft Defender Antivirus running with the latest Defender updates.

Next steps: We are working to release a resolution in a future Microsoft Defender Antivirus update and will provide more information when it is available.

Affected platforms:

Client: Windows 11, version 26H1; Windows 11, version 25H2; Windows 11, version 24H2; Windows 11, version 23H2; Windows 10, version 22H2; Windows 10, version 21H2; Windows 10 Enterprise LTSC 2019; Windows 10 Enterprise LTSC 2016

Server: Windows Server 2025; Windows Server 2022; Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012

Answer 2

Hi Vlad Vlad,

Thank you for providing the event details. Based on the behavior you described, the log sequence appears consistent with Microsoft Defender completing a normal service restart or initialization process and successfully returning to an active state. The fact that Windows Security showed Defender as enabled immediately afterward is a positive indication that protection was running normally.

As an additional check, you may want to:

Open Event Viewer and review any Defender events that occurred at the same time as the notification.
Look for events indicating that real-time protection was explicitly disabled and whether it was subsequently re-enabled.
Monitor whether the notification reappears after future Defender platform or security intelligence updates.

If the notification was only momentary and Defender continues to report that all protections are active, this generally suggests the service recovered successfully and no further action is required at this time.

I understand unexpected security notifications can be concerning. If the behavior becomes frequent or you begin seeing Defender remain disabled after startup, please share any new event IDs or screenshots, and the community can help review them further.

Feel free to ask me by clicking "Add Comment" or "Add Answer" if you cannot add comment so your response will be visible. Thanks for your effort.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.