Windows 11 Showing ‘Turn On Virus Protection’ When It’s Already On? Here’s the Real Fix (2026)

Windows 11 build 26200.9168 shipped on August 11, 2026, and within days, reports of a false “turn on virus protection” notification started stacking up on Microsoft’s own support forums. Several people noticed it lands at almost exactly the same point after every restart — around the four-minute mark, similar to how other 24H2-era bugs tended to trace back to a specific cumulative update rather than a hardware fault.

Here’s how to confirm Defender is actually fine, the PowerShell fix that clears the notification for most people, and what to try if it comes back.

Contents

• Why Is Windows 11 Suddenly Telling You to Turn On Virus Protection?
• Confirm Defender Is Actually Running First
• How Do You Fix the Notification With PowerShell?
• A Simpler Restart-Based Fix If PowerShell Feels Risky
• Does Clearing Defender’s Threat History Help?
• Where This Fix Goes Sideways
• Is This Actually a Security Risk, or Just a Display Bug?
• Which Fix Should You Try First, Based on What You’re Seeing?

Why Is Windows 11 Suddenly Telling You to Turn On Virus Protection?

Windows Security is misreading Windows Defender’s status on startup after the August 2026 update, so it shows a “turned off” warning even while Defender keeps running normally in the background.

When I checked Microsoft’s own Q&A thread on the issue, a user’s PowerShell diagnostics showed AMRunningMode, RealTimeProtectionEnabled, and AntivirusEnabled all reporting healthy — while the notification kept firing anyway. That’s the tell that this is a UI-layer bug in the Security Health service, not an actual protection gap.

Microsoft’s own release notes for KB5121003 don’t list this notification bug as a known issue as of this writing, even though the reports on Microsoft’s own community forums are widespread. That gap matters practically — there’s no official patch to just wait for right now, so fixing it yourself is the only option.

Confirm Defender Is Actually Running First

Before changing anything, verify Defender’s real status directly instead of trusting the notification either way.

Open PowerShell as Administrator and check Defender’s status

Right-click the Start button, choose Terminal (Admin), and run Get-MpComputerStatus. Look at three fields: AntivirusEnabled, RealTimeProtectionEnabled, and AMServiceEnabled. If all three read True, Defender is working, regardless of what the notification says.

Check the Windows Security app’s own status page

Open Windows Security, go to Virus & threat protection, and look for a green checkmark under Virus & threat protection settings. A mismatch between a green checkmark here and a red warning notification elsewhere is itself a sign of the display bug rather than a real problem.

This part trips up a lot of people. They see one red warning and assume the worst, when a 30-second PowerShell check would have shown Defender running the whole time.

It’s worth doing both checks rather than just one, since a mismatch between them is itself useful diagnostic information. If PowerShell reports everything healthy but the Security app’s own dashboard also shows a warning, that points more toward the notification-timing bug than a corrupted install — which changes which fix you should try first.

How Do You Fix the Notification With PowerShell?

Resetting the Windows Security app’s UI component through PowerShell clears the false notification for most affected users without touching Defender itself.

Open an elevated PowerShell window

Right-click Start, select Terminal (Admin), and confirm the User Account Control prompt.

Run the reset command

Type Get-AppxPackage Microsoft.Windows.SecHealthUI | Reset-AppxPackage and press Enter. This reinitializes the Security Health UI component responsible for reading and displaying protection status, without reinstalling or disabling Defender itself.

Restart your PC and watch the four-minute mark

Since the notification tends to reappear around the same point in the boot sequence for affected users, restart once and give it a few minutes rather than assuming the fix failed immediately.

A Simpler Restart-Based Fix If PowerShell Feels Risky

Restarting the Security Center service through the Services app clears the notification for some users without needing a command line at all.

Open the Services app

Press Windows+R, type services.msc, and press Enter.

Find and restart Security Center

Scroll to Security Center, right-click it, and select Restart. If Restart is greyed out, select Stop, wait a few seconds, then Start.

I found that this fix works less consistently than the PowerShell reset in the reports I read through, but it’s worth trying first if you’d rather avoid the command line entirely.

Does Clearing Defender’s Threat History Help?

Clearing Defender’s cached threat history resolves the notification for some users whose issue is tied to a stale scan-result cache rather than the Security Health UI itself.

Go to Windows Security, open Virus & threat protection, click Protection history, and clear old entries manually rather than relying on a third-party script for this step — it’s slower, but it doesn’t require trusting an unfamiliar executable with admin rights. If you’ve already tried the PowerShell reset and the restart-service fix without luck, this is the next thing worth checking before moving to deeper diagnostic tools. The same close-a-stuck-cache logic shows up in clearing out Chrome’s memory bloat on Windows — a lot of Windows 11 quirks this year trace back to a service holding onto stale state.

Where This Fix Goes Sideways

Reinstalling or resetting Windows Defender itself does nothing for this bug, because Defender was never actually broken in the first place — the problem sits in the notification layer reading its status, not in Defender.

A second-guess a lot of people make: assuming a third-party antivirus conflict is the cause and uninstalling Defender-adjacent tools that have nothing to do with the actual bug. If you’re running a third-party antivirus alongside Windows Security, that’s a separate, legitimate conflict worth checking on its own terms — but it’s not what’s causing this specific KB5121003-linked notification for users running Defender as their only protection.

Is This Actually a Security Risk, or Just a Display Bug?

It’s a display bug. Microsoft’s own community responses on the affected threads confirm Defender keeps running normally, and the PowerShell status checks back that up independently of what the notification claims.

You’ll probably still want to run the fix rather than just dismiss the notification every reboot, since a persistent false warning trains you to ignore security notifications in general — which is a bad habit precisely because most of the time that notification is telling you something real.

Roughly a handful of the threads I read through mentioned the notification eventually stopped on its own after a later cumulative update, without anyone changing a setting. That’s not something to plan around, though — it happened for some systems and not others, and there’s no pattern in the reports that explains why.

Which Fix Should You Try First, Based on What You’re Seeing?

What Should You Check Before You Run Any Fix?

• ✅ Run Get-MpComputerStatus first so you know your actual starting point, not just what the notification claims.
• ✅ Note whether the notification appears at a consistent point after restart — that pattern is a strong sign of this specific bug rather than a different issue.
• ✅ Keep Windows Update current; even without an official fix yet, Microsoft has patched similar Security Health display bugs in past cumulative updates.

What Could Go Wrong If You Skip a Step?

• ⚠️ Don’t uninstall or disable Windows Defender to “fix” this — that removes your actual protection over a notification bug that isn’t real.
• ⚠️ Only download diagnostic or cleanup tools from sources you can verify, and skip anything that asks for admin rights before you’ve confirmed what it does.
• ⚠️ If Get-MpComputerStatus actually shows protection disabled, that’s a different, real problem — don’t assume it’s this display bug without checking first.

FAQ

Will a future Windows update fix this automatically?

Possibly, once Microsoft acknowledges it as a known issue and ships a targeted fix, but as of this writing it isn’t listed in the official KB5121003 release notes, so there’s no confirmed timeline to wait for.

Does this bug affect Windows 10 as well as Windows 11?

The reports tied to KB5121003 are specific to Windows 11 24H2 and 25H2 builds. Windows 10 uses a different update track, so this particular notification bug is not confirmed on Windows 10.

Can I just turn off the notification instead of fixing the underlying bug?

You can mute individual Windows Security notifications, but that also silences real future alerts from the same channel, so running the PowerShell reset is the safer option if you want the warning gone for good.

Sources

• Microsoft Support — KB5121003 (OS Builds 26200.9168 and 26100.9168)
• Microsoft Q&A — Repeated “Turn on virus protection” notification
• Microsoft Q&A — Persistent “Turn on Virus Protection” notifications

Fact-checked based on 3 public sources as of August 18, 2026. Build numbers, KB identifiers, and Microsoft’s official known-issues list can change as Microsoft investigates further — check Microsoft’s own KB5121003 page for the current status before assuming this remains unpatched.