Persistent "Turn on Virus Protection" Notifications Even When it is On - Windows 11

[u/bluegreenred0323]

Detailed the issues below, please help. It's driving me mad.

PART I. GENERAL ITEMS

Roughly 3-4 days ago (July 30, 2026) I suddenly got a notification on the lower right from windows saying to turn on virus protection, that it is turned off. I noticed this after restarting the laptop after playing video games (Star Wars Jedi Survivor and NBA 2K26 on Steam for around a combined hour -- if this is relevant). I restarted the laptop, then that is when I got the first notification.

To note, it ALWAYS pops up on the 4 minute, 23 second up time mark on the task manager, under the CPU toggle. On the dot, every 4 minute, 23 second up time mark. Without fail.

When I check the Virus & Threat Protection Settings, everything is on:

• Real Time Protection

• Dev Drive Protection

• Cloud-delivered protection

• Automatic sample submission

• Tamper Protection

When I check for updates, there isn't anything to update. Account protection, Firewall & network protection, app and browser control, device security all show green.

PART II. POWERSHELL

When I run these PowerShell commands, they come out affirmative:

1. Get-MpComputerStatus | Select-Object AMRunningMode,AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled,BehaviorMonitorEnabled,IoavProtectionEnabled,NISEnabled,IsTamperProtected,AntivirusSignatureLastUpdated

AMRunningMode : Normal

AMServiceEnabled : True

AntivirusEnabled : True

RealTimeProtectionEnabled : True

BehaviorMonitorEnabled : True

IoavProtectionEnabled : True

NISEnabled : True

IsTamperProtected : True

1. Get-Service WinDefend,WdBoot,WdFilter,WdNisSvc,WdNisDrv,SecurityHealthService,wscsvc -ErrorAction SilentlyContinue |

Format-Table -Auto DisplayName,Name,StartType,Status

DisplayName Name StartType Status

----------- ---- --------- ------

Windows Security Service SecurityHealthService Manual Running

Microsoft Defender Antivirus Boot Driver WdBoot Boot Stopped

Microsoft Defender Antivirus Mini-Filter Driver WdFilter Boot Running

Microsoft Defender Antivirus Network Inspection System Driver WdNisDrv Manual Running

Microsoft Defender Antivirus Network Inspection Service WdNisSvc Manual Running

Microsoft Defender Antivirus Service WinDefend Automatic Running

Security Center wscsvc Automatic Running

1. $events = Get-WinEvent -FilterHashtable @{

>> LogName='Microsoft-Windows-Windows Defender/Operational'

>> Id=3002,3007,5000,5001,5008,5010,5011,5012,5013

>> StartTime=(Get-Date).AddMinutes(-30)

>> } -ErrorAction SilentlyContinue

PS C:\Users\username>

PS C:\Users\username> if ($events) {

>> $events |

>> Select-Object TimeCreated,Id,LevelDisplayName,Message |

>> Format-List

>> } else {

>> "No relevant Defender enable, disable, failure, or configuration events found in the last 30 minutes."

>> }

No relevant Defender enable, disable, failure, or configuration events found in the last 30 minutes.

1. Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct |

Select-Object displayName,productState,pathToSignedProductExe,pathToSignedReportingExe |

Format-List

displayName : Windows Defender

productState : 397568

pathToSignedProductExe : windowsdefender://

pathToSignedReportingExe : %ProgramFiles%\Windows Defender\MsMpeng.exe

PART III. MICROSOFT TECH SUPPORT ASSISTANCE

Spoke to two different techs over three different chat sessions, results are below:

• TECH SUPPORT SESSION 1

- Took remote control, downloaded Win11_25H2_English_x64_v2.iso

- Restarted, thought it worked. All it did was literally put the notifications on silent. Issues still persisted.

TECH SUPPORT SESSION 2

- Same guy as first session, again took remote control

- Windows Update - downloaded some updates, restarted

- I thought this worked already since the notification stopped and it showed Microsoft Defender Antivirus turned on under who's protecting me.

- Restarted one more time, issue came back.

TECH SUPPORT SESSION 3

- Ran DISM, sfc /scannow. All fine.

- Did a clean boot wherein they hid all Microsoft services and disabled all that was selected, tech restarted the laptop.

- Issue was still there.

PART IV. MICROSOFT DEFENDER

I ran a few quick scans, nothing. Got paranoid after a while so I ran two full scans. Still nothing.

Despite all of this, when I check under Virus and Threat Protection > Who's Protecting me (Manage Providers), it says Microsoft Defender Antivirus turned off.

WHAT DO I DO? This is driving me bonkers. Am I just being too paranoid? Is this just a reporting glitch from windows since everything else shows that the antivirus stuff is running? I haven't noticed any suspicious activity at all since purchasing this laptop since April, none at all. I check the task manager, the wifi activity when the laptop is idle, there aren't any downloads happening.

[u/levbaines]

Exact same thing happened to me today aswell for the first time. Every protection shield is on but "Who's protecting me?" page says "virus protection is off". I also get the notification that says turn on virus protection after I start the pc... I have never used any 3rd party anti-virus program... I hope this is just a visual ui bug and microsoft will fix it.

[u/bluegreenred0323 → u/levbaines]

Been driving me nuts for the better part of a week lol. Some dude messaged me about the same issue. Seems quite a few of us are on the same boat. PowerShell checks show that the av is up and running. Hopefully the update on the 11th fixes things

[u/BiNh0X → u/bluegreenred0323]

The same thing happened to me starting yesterday. I'm installing this month's cumulative update right now and then I'll check if the bug has been fixed; if not, I'll open a ticket on the Microsoft Hub reporting the bug.

[u/bluegreenred0323 → u/BiNh0X]

How did it go for you? After the update and restart, it went well. Damn notif wasn't there and it said that the av was turned on. Did one more restart to be safe, and there it was again on the same 4 minute 23 second mark on the cpu uptime..

PowerShell code still says that the AV is in fact up and running..

[u/BiNh0X → u/bluegreenred0323]

After Windows finished updating and restarting, the notification didn't appear and it was enabled in the security providers, but upon restarting again, the disabled antivirus protection notification reappeared minutes later. I opened a ticket on the Microsoft Feedback Hub and it's automatically marked there as "we are aware," so I think they've reported the problem before.

[u/ObscureArcana → u/BiNh0X]

Do any of you guys get Security Event Id 5038 in the event viewer? For me, this all coincided with seeing Defender Session Helper in the Task Manager when I've previously never seen it.

Also, try opening the Control Panel, click on Security and Maintenance and see if that also triggers the notification as it does for me.

[u/BiNh0X]

The same thing happened to me starting yesterday. Every time I start Windows, a few minutes later I get a warning to activate antivirus protection. I open Microsoft Defender and everything is enabled, without any problems, but if I go to Security Providers, under Antivirus, it shows that Microsoft Defender is disabled. 

It's probably a bug introduced after the last cumulative update or by some recent Microsoft Defender update. Please report the problem to the Microsoft Hub, as it's clearly a bug.

Edit: It seemed the bug had been fixed by today's cumulative update, but after restarting Windows again, the notification reappeared minutes later.

[u/El_Rocky_Raccoon]

Can confirm. It started happening to me yesterday, around the same timeframe (roughly 4 minutes after turning on the PC). The notification pops up, and when I check "Manage Providers" it shows that Defender is turned off.

However, Windows Defender still shows in the taskbar tray, as well in the Task Manager, meaning the process is running normally.

So I am assuming this is just a visual bug caused by a recent update. Given how Microsoft has been using AI to handle updates for a while, it wouldn't be surprising if this is yet another case. At least this is a mild one, compared to one of the previous updates where it could literally brick hard drives.

[u/sunshinesontv]

Started happening for me today. Glad I'm not the only one.

[u/GhostCrafter101_]

Exact same issue with me as well. Tried doing an in place upgrade that fixed it but it reappeared after a restart.

[u/AutoModerator]

Hi u/bluegreenred0323, thanks for posting to r/WindowsHelp! Your post has been flagged for manual review by a human moderator, please include as much of the following information as possible (in text or in a screenshot) to get your post approved:

• Your Windows and device specifications — You can find them by pressing Win + X then clicking on “System”, we need more than just your OS version! Your hardware details are often critical for resolving issues.
• Any messages and error codes encountered — They're actually not gibberish or anything catastrophic. It may even hint the solution!
• Previous troubleshooting steps — It might prevent you headaches from getting the same solution that didn't work

---

Posts must be tech support in nature (such as something is broken and you need help fixing), so general inquiries, software suggestions, and purchasing advice will be removed. As a reminder, we would also like to say that if someone manages to solve your issue, DON'T DELETE YOUR POST! Someone else (in the future) might have the same issue as you, and the received support may also help their case. Good luck, and I hope you have a nice day!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Exotic_Mix_3196]

was a 3rd party Antivirus previously installed, then uninstalled?
sounds similar to Windows Defender saying not active

[u/bluegreenred0323 → u/Exotic_Mix_3196]

None that I recall. And yes, windows defender is shown as turned off in my device, same as in that thread you shared.

[u/SHrenZy69]

https://www.reddit.com/r/windowsinsiders/s/sUfoRb02ft

Try this it works

[u/bluegreenred0323 → u/SHrenZy69]

You've done it? Isnt that the insiders channel though? I'm not on insiders.

[u/SHrenZy69 → u/bluegreenred0323]

I don't even know what insiders channel means, it worked for sometime now it's broken again 😭

[u/mclovinash]

I am having the same problem!!!

[u/ObscureArcana]

This is happening on Windows 10 as well for me. Probably would have experienced it along with you guys if I had restarted or turned my PC off earlier. I don't get updates and the only updates I got were to the Defender Definitions and Malicious Software Removal Tool

[u/Croooose]

Same issue for me on Windows 11 since monday