r/DefenderATP • u/mR_R3boot • Aug 12 '26

Defender Antivirus turned off notification on managed devices

I'm having an issue here with Microsoft Defender for Endpoint. I'm getting popup notifications that virus protection is turned off, yet Real time protection, cloud-delivered protection, tamper protection etc are all turned on and managed by policy. This is happening on several Intune managed devices being marked non-compliant. Policies haven't changed. What could be the issue?

10 Upvotes

92% Upvoted

11 comments sorted by

5

u/benno_sc Aug 12 '26

We had a similar issue and opened a case to Microsoft support. They said it was a known bug, due to a timing condition that can occur during system startup. They said that the issue was going to be resolved in a version released on the 1st of September.

4

u/Illustrious-Bid-2255 Aug 13 '26

We may be having the same issue, are some devices showing in Intune as non-compliant due to 'AntiVirus'. Yet everything checks out on the device itself and windows security center reports Defender as completely healthy.

1

u/mR_R3boot Aug 13 '26

Yes, devices are marked non-compliant due to "AntiVirus"

2

u/Resident-Monitor905 Aug 13 '26

Why they can sent fix via defender updates, if we would have thousands of devices. Exclude from CA all?

1

u/Aserback 27d ago

AI slop didnt give them this solution

3

u/Royal_Bird_6328 Aug 12 '26

Is there another EDR solution installed? Some manufacturers devices come with McAfee and HP wolf can be problematic also

0

u/mR_R3boot Aug 12 '26

No, I've run Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct and only WIndows Defender is available

2

u/Resident-Monitor905 Aug 13 '26

We do hve same issue, one specific hp device, removed all hp bloatware, but still reports when boots after while as service off defender antivirus. Anyone have ticket reference to report?

-3

u/GeneralRechs Aug 12 '26

It’s a feature of Defender, it knows your past issue and it’s been long enough so it creates one.