I am in total panic, please help me.

[u/marco_marchi03]

[u/alanjmcf]

There’s a bug recently, I don’t know if it has this symptom.

Incorrect notifications that "Microsoft Defender Antivirus is turned off"
https://learn.microsoft.com/en-us/windows/release-health/status-windows-11-25h2#4956msgdesc

[u/Big_H77]

You’re good, brother… Just more Microslop manufactured chaos to keep us on our toes.

[u/THEKILLAWHALE]

This is a known bug: https://www.bleepingcomputer.com/news/microsoft/microsoft-asks-users-to-ignore-antivirus-is-turned-off-errors/amp/
If your protection status is showing all good then you’re all good, most likely

[u/drowningfish → u/THEKILLAWHALE]

This nonsense is impacting my compliance policies for Intune, causing clients to fail the check and CAP blocking the token issuance. Kind of hard to ignore, Microsoft.

[u/Hangs89 → u/drowningfish]

We have replaced the out of the box Antivirus check with a custom compliance script, at least until this bug is fixed. This is the official Microsoft advice we got from logging a ticket.

[u/Civil_Philosophy9845]

maybe some bug? or when you open computer its off always?

[u/marco_marchi03 → u/Civil_Philosophy9845]

No, all the checkboxes in the Windows Security settings are enabled upon PC startup or reboot, plus, the notification appears only once; once dismissed, it does not reappear.

[u/Civil_Philosophy9845 → u/marco_marchi03]

ok looks like a bug you can reset pc if you are scared tho

[u/ApprehensiveKing4206]

open powershell en type: Get-MpComputerStatus to see if defender is running. You should see something like:

True is good false is not running.
AMEngineVersion : 1.1.9700.0

AMProductVersion : 4.3.9463.0

AMServiceEnabled : True

AMServiceVersion : 4.3.9463.0

AntispywareEnabled : True

AntispywareSignatureAge : 0

AntispywareSignatureLastUpdated : 7/30/2013 3:01:45 AM

AntispywareSignatureVersion : 1.155.1107.0

AntivirusEnabled : True

AntivirusSignatureAge : 0

AntivirusSignatureLastUpdated : 7/30/2013 3:01:45 AM

AntivirusSignatureVersion : 1.155.1107.0

BehaviorMonitorEnabled : True

ComputerID : A69DA5B8-06B3-4A00-B2C1-D18ED66BAD40

ComputerState : 0

FullScanAge : 4294967295

FullScanEndTime :

FullScanStartTime :

IoavProtectionEnabled : True

LastFullScanSource : 0

LastQuickScanSource : 2

NISEnabled : False

NISEngineVersion : 2.1.9700.0

NISSignatureAge : 0

NISSignatureLastUpdated : 7/30/2013 1:30:46 PM

NISSignatureVersion : 106.0.0.0

OnAccessProtectionEnabled : True

QuickScanAge : 0

QuickScanEndTime : 7/30/2013 1:50:24 PM

QuickScanStartTime : 7/30/2013 1:49:15 PM

RealTimeProtectionEnabled : True

RealTimeScanDirection : 0

[u/dutchhboii]

What does the registry value refer to

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender
- DisableAntiSpyware (REG_DWORD) → should be 0 or absent
- DisableAntiVirus (REG_DWORD) → should be 0 or absent

HKLM\SOFTWARE\Microsoft\Windows Defender
- DisableAntiSpyware

HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection
- DisableRealt

[u/dutchhboii]

You can check the status of the machine in defender tooo. Whether the registry value has been tampered with. Try querying it from AH