Additional Microsoft Defender tools and services that provide security across various platforms and environments
This is most likely a false notification rather than Microsoft Defender actually being off.
The strongest sign is that Windows Security shows green checks and “No action needed” in the protection areas. There is also a documented known issue where incorrect notifications say “Microsoft Defender Antivirus is turned off” even though Microsoft Defender Antivirus remains active and functioning correctly.
What to do:
- Verify real-time protection status
- Open Windows Security.
- Go to Virus & threat protection > Manage settings.
- Check Real-time protection.
- If it is already On, Defender Antivirus is enabled.
- Check whether the alert is coming from Windows Security or from Edge site notifications
- If the message appears specifically when opening Edge, it can be a browser push notification rather than a real Defender alert.
- In Microsoft Edge, open notification permissions and remove unfamiliar sites from the Allow list.
- If needed, turn off Ask before sending to block site notifications entirely.
- Review Windows Security notification settings
- Open Windows Security > Settings > Manage notifications.
- Windows Security can show informational notifications, but it will still show urgent notifications when immediate action is required.
- If the device is managed by a work or school organization, some notification settings may be controlled by an administrator.
- Check Protection history
- In Windows Security, open Protection history.
- Look for alerts such as An important service is off. If present, open the alert card and use Actions to turn the feature back on.
- If the notification continues and Defender is confirmed on
- Report it through Feedback Hub using WIN+F so diagnostics can be collected for investigation.
Why this is happening:
- A current documented issue can show incorrect “Microsoft Defender Antivirus is turned off” notifications even when Defender is working correctly.
- Because the message appears when opening Edge, it may also be a website notification/push notification that only looks like a Windows security alert.
- Nord VPN is not identified in the available documentation as the cause.
- Stay protected with the Windows Security app
- Protection History in the Windows Security App
- Windows Security App Settings
- Windows Security App Overview
- Windows 10, version 1809 and Windows Server 2019 known issues and notifications
- Windows Pop-up "Turn on virus protection" notification despite Windows Defender being already turned ON. - Microsoft Q&A
- How do I remove a persistent fake-virus alert popup? - Microsoft Q&A