Running a powershell command to verify that Defender Antivirus is turned on

Question

Windows 11 26H2 26300.9278 Release Preview

for 3-4 months now I've had notifications pop up that Defender Antivirus was Turned OFF. So I went from 25H2 Release Preview and did a clean install of 25H2 Public Release only to have the same notifications show up again. This morning I saw that 26H2 had been released so I "rejoined" the Insider Release Preview channel to get 26H2. And just now that notification popped up again that Defender Antivirus was turned OFF.

Anyways I found a PowerShell command to verify if Defender was actually running. which it is, when I noticed something odd.

Has anyone else seen this?

The DeviceControlPolicies were last updated 462 YEARS AGO? 12/31/1600 ?

Thought this might be worth some chuckles out there....

Answer 1

Kirbster,

Please make sure to file Feedback

in the Feedback Hub. This issue is

being investigated but they need reports

filed.

Answer 2

That date is effectively a zero/uninitialized timestamp. In other words, Windows has no valid "last updated" timestamp for DeviceControlPolicies, so the underlying value is being displayed as the earliest/default date rather than a real policy update date.

This can happen when there is no Device Control policy being applied or when the component has never received a valid policy timestamp. It should not be interpreted as evidence that Defender has been disabled,

The more significant issue is the repeated Windows Security notification saying that Microsoft Defender Antivirus is turned off. Since you have already seen this behavior through multiple installations, including a clean installation of Windows 11 25H2, and now again on the 26H2 Release Preview build, I would not assume that the notification means Defender itself is actually stopped.

The PowerShell check is much more useful here. Run:

Get-MpComputerStatus | Select-Object AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled,BehaviorMonitorEnabled,IoavProtectionEnabled,NISEnabled,AntispywareEnabled

If those values are True, particularly AMServiceEnabled, AntivirusEnabled, and RealTimeProtectionEnabled, then Defender Antivirus is running and providing real-time protection. In that situation, the Windows Security notification is likely reporting an inconsistent or stale security status rather than reflecting the actual state of the Defender engine.

You can also check the Defender service directly with:

Get-Service WinDefend

Normally you should see the service in a Running state. You can also check the Windows Security UI under Windows Security > Virus & threat protection and confirm that it reports real-time protection as being on.

The DeviceControlPolicies timestamp should therefore be treated separately from the "Defender Antivirus is turned off" notification. Device Control is a Defender feature concerned with controlling access to devices such as removable storage. Unless you have deliberately configured a Microsoft Defender Device Control policy, there may simply be no meaningful policy timestamp for Windows to display.

The fact that you performed a clean installation and the same Defender warning subsequently returned is actually useful information. It makes a damaged installation of Windows considerably less likely. I would instead look at what Windows Security believes the registered antivirus/security-provider state is, and whether something is periodically causing that state to be reported incorrectly.

One particularly useful next step would be to capture the output of:

Get-MpComputerStatus | Format-List *

when the "Defender Antivirus is turned OFF" notification actually appears. That gives you the Defender engine's state at the exact time Windows is claiming it is disabled. If the Defender status is still healthy at that moment, we can then narrow this down to the Windows Security notification/status mechanism rather than troubleshooting Defender as though it were turned off.

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin