Forum Discussion
"Turn on Virus Protection" Notification appears after the latest update
So after the latest Windows 11 update I constantly get a single notification from Windows Defender claiming that it was turned off and suggesting to "Turn on Virus Protection". Fun fact is that Defender keeps working all the time and never turns off. Another fun fact is that the notification appears at the same exact time, 4m13sec after logging into account (judging by task manager uptime timer). I've heard a similar story from another user experiencing the same issue after latest update, but for him the notification appears at 4m23sec.
I contacted support and they said that they might require multiple feedbacks on this issue from different users to confirm that it's a bug. While my PC was checked by Microsoft support team member and he confirmed that there's no issue with my system. Everything runs perfectly fine and working as it should.
From the side it looks like it's some scheduled event bug, however upon checking task scheduler there was nothing to trigger this notification. As well as event manager shows no visible signs of critical errors on that matter (or at least I don't see any).
It's extremely concerning to me, cause it's the first issue related to Windows Security which happened to me since my first day of using Windows 11. And there's no trace of it, so basically it's unable to identify the source of this bug.
Reinstalling system helped for a while, but after several hours a few minor security updates were installed, and the notification came back. Like i said, it appears only once after each account log in. If my PC goes to sleep, I can wake it up as many times as I want and it won't show it ever again.
Can anyone confirm the same weird behavior after the latest updates? If so, is anyone willing to send a feedback?
This is a known issue reported widely in forums. It might be caused by July Cumulative Update Preview or August Cumulative Updates. We may expect a fix from September Cumulative Updates.
Till then you can upvote the already reported feedback here in the Feedback hub:
Hope this helps!
16 Replies
Same problem here on my build
Open Windows Security and confirm Virus & threat protection shows no action needed, then check Protection history and Event Viewer around the exact 4-minute mark. After the next occurrence, submit Feedback Hub under Security and Privacy > Microsoft Defender Antivirus, include the build number, notification screenshot, and note that Microsoft Support already confirmed Defender is running. In the meantime, avoid disabling Defender services or clearing security components.
Respect, first of all, after 2 days I restarted my PC and after a few minutes, that is, for example, about 3 to 4 times, the same message appeared, I thought it was a virus, I scanned everything and everything was normal, until I came across your POST, so I'm not the only one who has this problem.
added: i will restart explorer like 3 4 minut later notification got again.
I'm running Windows Eleven insider build: 26220.9022
The same behavior has been occurring on my machine for about six weeks now.
It occurs about four minutes or so after I restart, or about 90 seconds after I restart explorer.exe.
I've been ignoring it because I read on the Windows 11 sub on Reddit that it was a known bug, but I think I'll put it in the feedback hub, to be on the safe side.
Yes I've heard that people on insiders builds started noticing this bug earlier. But average users I guess encountered it after July 31st. For me it personally started after August 4th. And yes, I can confirm that upon restarting explorer (or in my case logging out and logging back into my user profile) the notification comes earlier.
I was suggested by AI to log the notifications with logman command and it captured this notification with a weird error related to 0x80070006 ("Invalid handle") in toastsession.cpp(829) and tilesession.cpp(494), which is a bird language for me. But since no events or scheduled tasks are logged into my user journals, I believe it's a bug on the Microsoft side.
Microsoft Support suggested each user facing this bug to submit a bug via Feedback Hub. I also suggest mentioning that it happens roughly 4 mins after startup (depending on user setup). Like i said, the only trace which could lead to some conclusion was found in the log created by a "logman" command. It's not in the event viewer, not in the task scheduler, nothing is triggered on the processes side as well. Basically it looks like a "fake" notification generated in Security Center by mistake.
Yes can confirm I am also having this issue. Defender is active yet about 5 minutes after boot up I receive this notification.
Event Viewer shows a normal Defender boot sequence with no errors.
Build OS: 26220.9022
