Persistent "Turn on Virus Protection" Notifications Even When it is On - Windows 11

Question

Wrote in detail the steps I took below. This is driving me crazy.

PART I. GENERAL ITEMS

Roughly 3-4 days ago (July 30, 2026) I suddenly got a notification on the lower right from windows saying to turn on virus protection, that it is turned off. I noticed this after restarting the laptop after playing video games (Star Wars Jedi Survivor and NBA 2K26 on Steam for around a combined hour -- if this is relevant). I restarted the laptop, then that is when I got the first notification.

To note, it ALWAYS pops up on the 4 minute, 23 second up time mark on the task manager, under the CPU toggle. On the dot, every 4 minute, 23 second up time mark. Without fail.

When I check the Virus & Threat Protection Settings, everything is on:

• Real Time Protection

• Dev Drive Protection

• Cloud-delivered protection

• Automatic sample submission

• Tamper Protection

When I check for updates, there isn't anything to update. Account protection, Firewall & network protection, app and browser control, device security all show green.

PART II. POWERSHELL

When I run these PowerShell commands, they come out affirmative:

1. Get-MpComputerStatus | Select-Object AMRunningMode,AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled,BehaviorMonitorEnabled,IoavProtectionEnabled,NISEnabled,IsTamperProtected,AntivirusSignatureLastUpdated

AMRunningMode : Normal

AMServiceEnabled : True

AntivirusEnabled : True

RealTimeProtectionEnabled : True

BehaviorMonitorEnabled : True

IoavProtectionEnabled : True

NISEnabled : True

IsTamperProtected : True

2. Get-Service WinDefend,WdBoot,WdFilter,WdNisSvc,WdNisDrv,SecurityHealthService,wscsvc -ErrorAction SilentlyContinue |

Format-Table -Auto DisplayName,Name,StartType,Status

DisplayName Name StartType Status

---

Windows Security Service SecurityHealthService Manual Running

Microsoft Defender Antivirus Boot Driver WdBoot Boot Stopped

Microsoft Defender Antivirus Mini-Filter Driver WdFilter Boot Running

Microsoft Defender Antivirus Network Inspection System Driver WdNisDrv Manual Running

Microsoft Defender Antivirus Network Inspection Service WdNisSvc Manual Running

Microsoft Defender Antivirus Service WinDefend Automatic Running

Security Center wscsvc Automatic Running

3. $events = Get-WinEvent -FilterHashtable @{

LogName='Microsoft-Windows-Windows Defender/Operational'

Id=3002,3007,5000,5001,5008,5010,5011,5012,5013

StartTime=(Get-Date).AddMinutes(-30)

} -ErrorAction SilentlyContinue

PS C:\Users\username>

PS C:\Users\username> if ($events) {

$events |

Select-Object TimeCreated,Id,LevelDisplayName,Message |

Format-List

} else {

"No relevant Defender enable, disable, failure, or configuration events found in the last 30 minutes."

}

No relevant Defender enable, disable, failure, or configuration events found in the last 30 minutes.

4. Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct |

Select-Object displayName,productState,pathToSignedProductExe,pathToSignedReportingExe |

Format-List

displayName : Windows Defender

productState : 397568

pathToSignedProductExe : windowsdefender://

pathToSignedReportingExe : %ProgramFiles%\Windows Defender\MsMpeng.exe

PART III. MICROSOFT TECH SUPPORT ASSISTANCE (via Get Help on the start menu)

Spoke to two different tech support personnel over three different chat sessions, results are below:

• TECH SUPPORT SESSION 1

• Took remote control, downloaded Win11_25H2_English_x64_v2.iso
• Restarted, thought it worked. All it did was literally put the notifications on silent. Issues still persisted.

TECH SUPPORT SESSION 2

• Same guy as first session, again took remote control
• Windows Update - downloaded some updates, restarted
• I thought this worked already since the notification stopped and it showed Microsoft Defender Antivirus turned on under who's protecting me.
• Restarted one more time, issue came back.

TECH SUPPORT SESSION 3

• Ran DISM, sfc /scannow. All fine.
• Did a clean boot wherein they hid all Microsoft services and disabled all that was selected, tech restarted the laptop.
• Issue was still there.

PART IV. MICROSOFT DEFENDER

I ran a few quick scans, nothing. Got paranoid after a while so I ran two full scans. Still nothing.

Despite all of this, when I check under Virus and Threat Protection > Who's Protecting me (Manage Providers), it says Microsoft Defender Antivirus turned off.

WHAT DO I DO? This is driving me bonkers. Am I just being too paranoid? Is this just a reporting glitch from windows since everything else shows that the antivirus stuff is running? I haven't noticed any suspicious activity at all since purchasing this laptop since April, none at all. I check the task manager, the wifi activity when the laptop is idle, there aren't any downloads happening.

Answer 1

I can confirm i have the same exact issue which started at the same time after latest updates. While i haven't changed anything and even tried to reinstall my Windows. The notification alerts in the same exact time after startup - 4m15s and can't be traced with task scheduler or event viewer. It is just there. And yes, it doesn't actually turns off virus protection which stays on (while all related Defender services keep running).

The problem of this bug is that apparently very few users encountered it after the latest updates for Microsoft to look into it. But I hope they will fix it.

Answer 2

Please share your Farbar scan logs for analysis.

• Download Farbar Recovery Scan Tool 64-bit FRST64.exe
• If the OS language is not English, rename FRST64.exe to FRST64English.exe.
• Run the program. Don't check or uncheck any options. Click "Scan".
• Add the two logs, FRST.txt and Addition.txt, to a zip archive.
• Share the zip file on OneDrive or GoFile.io, and post the link here.

---

Note: If Microsoft Edge or Chrome mislabels the Farbar Scanner executable as PUA/malware, choose to keep it by tapping … in the bottom bar, choosing Keep, and then choosing Keep anyway in the dialog that appears. See this screenshot. It's a safe tool used in most antimalware forums.

---