If Windows Security shows Microsoft Defender is active, this notification does not by itself mean the PC is being attacked or hacked.
Microsoft has a confirmed issue where notifications can incorrectly say "Microsoft Defender Antivirus is turned off" even though Defender is functioning correctly and settings show it as active. These notifications can appear at startup and intermittently afterward, and can persist even if notification settings are turned off.
What to check:
- Open Windows Security and confirm Defender is shown as active.
- Check the notification area icon status:
- Green = protected
- Yellow = potentially unprotected
- Red = at risk
- Open Protection history in the Windows Security app and review whether there are actual alerts such as:
- Threat blocked
- Remediation incomplete
- An important service is off
If Windows Security still shows Defender is on and there are no real threat alerts in Protection history, this points to the known false notification issue rather than an active attack.
Microsoft is working on a fix in a future Microsoft Defender Antivirus update. If the pop-up keeps happening, report it through Feedback Hub using Win+F.
References: