Forum Discussion
"Turn on Virus Protection" Notification appears after the latest update
This is a known issue reported widely in forums. It might be caused by July Cumulative Update Preview or August Cumulative Updates. We may expect a fix from September Cumulative Updates.
UPDATE (18/09/2026): This issue has been resolved by Microsoft. If you're affected, pls install or update the Microsoft Defender Antivirus update (version 4.18.26080.4) update:
https://learn.microsoft.com/en-us/windows/release-health/resolved-issues-windows-11-25H2#august-2026
You can also refer detailed fix here:
https://www.kapilarya.com/turn-on-virus-protection-keeps-popping-up-in-windows-11
Hope this helps!
Note: Included link in this reply refers to blog post by a trusted Microsoft MVP.
I'm running Windows Eleven insider build: 26220.9022
The same behavior has been occurring on my machine for about six weeks now.
It occurs about four minutes or so after I restart, or about 90 seconds after I restart explorer.exe.
I've been ignoring it because I read on the Windows 11 sub on Reddit that it was a known bug, but I think I'll put it in the feedback hub, to be on the safe side.
Yes I've heard that people on insiders builds started noticing this bug earlier. But average users I guess encountered it after July 31st. For me it personally started after August 4th. And yes, I can confirm that upon restarting explorer (or in my case logging out and logging back into my user profile) the notification comes earlier.
I was suggested by AI to log the notifications with logman command and it captured this notification with a weird error related to 0x80070006 ("Invalid handle") in toastsession.cpp(829) and tilesession.cpp(494), which is a bird language for me. But since no events or scheduled tasks are logged into my user journals, I believe it's a bug on the Microsoft side.
Microsoft Support suggested each user facing this bug to submit a bug via Feedback Hub. I also suggest mentioning that it happens roughly 4 mins after startup (depending on user setup). Like i said, the only trace which could lead to some conclusion was found in the log created by a "logman" command. It's not in the event viewer, not in the task scheduler, nothing is triggered on the processes side as well. Basically it looks like a "fake" notification generated in Security Center by mistake.