Windows 11 has two separate bugs: a false Defender warning and a broken KB5120998 cursor

Microsoft is dealing with two different Windows problems, and they should not be confused. One is a false Microsoft Defender Antivirus notification that can appear even when protection remains active. The other is a regression linked to the optional August 27 preview update KB5120998, which can reset mouse-cursor customization on Windows 11 24H2 and 25H2. 23919

The quick distinction

• Seeing “Microsoft Defender Antivirus is turned off”? Verify Defender’s actual status before assuming the PC is unprotected.
• Installed KB5120998 and lost your cursor settings? Because the update is optional, skip it if you have not installed it. If it is already causing trouble, uninstalling it is the most practical rollback reported so far. 123

1. The Defender warning is a false status report

Microsoft has confirmed reports that Windows can display a notification saying “Microsoft Defender Antivirus is turned off” after recent Defender Antivirus updates, even though Defender remains active and Windows Security shows the protection settings enabled. The alert may appear at startup or intermittently afterward. 949

The publicly available information does not identify the precise Defender component or version responsible. The issue is best understood as a mismatch between the notification and Defender’s actual operating state—not, by itself, evidence that malware protection has stopped.

Microsoft’s release-health information lists the problem for Windows 11 version 23H2, and reports describe the same false alert on other Windows 11 and Windows 10 systems. The exact Windows 10 servicing coverage is not clearly specified in the available documentation, so users should verify their device rather than rely only on the notification. 949

How to check whether Defender is really running

1. Open Windows Security.

2. Select Virus & threat protection.

3. Confirm that real-time protection and the protection status are enabled.

4. As an additional check, open Command Prompt as administrator and run:

   sc query WinDefend
   

   If the result shows STATE : 4 RUNNING, the Microsoft Defender Antivirus service is running.

Do not disable, reinstall, or replace security software solely because of this warning. If Windows Security shows a genuine protection problem, or the service is not running, treat that as a separate issue and investigate it normally. Microsoft has acknowledged the false notification and is working on a resolution, but no public fix date or detailed root cause has been provided. 4953

2. KB5120998 can reset mouse customization

KB5120998 is the optional August 27, 2026 preview cumulative update for Windows 11 versions 24H2 and 25H2. It corresponds to OS build 26100.9278 on 24H2 and 26200.9278 on 25H2. 19

Microsoft’s official release-health entries acknowledge reports that custom mouse cursors and cursor animations may intermittently revert after installation. The update is marked as a reported issue for both Windows 11 versions. 23

Users and technology publications have also reported related symptoms, including an oversized or default white cursor, an inability to restore a chosen cursor scheme, an apparently missing cursor, and a desktop wallpaper changing to a solid black background. The evidence is not equally strong for every symptom: Microsoft’s formal entry specifically documents lost mouse customization, while the wallpaper and disappearance reports remain less formally characterized. 13336

What affected users should do

If KB5120998 is not installed: skip the optional preview update for now. Preview releases are not required in order to receive the normal monthly security update, and waiting avoids taking on a known personalization regression.

If KB5120998 is already installed and caused the problem:

1. Open Settings → Windows Update → Update history.
2. Select Uninstall updates.
3. Find KB5120998.
4. Uninstall it and restart the PC.

Microsoft support guidance cited in the available reporting also recommends removing the update and pausing updates temporarily while waiting for a newer build. 1

Some Microsoft release-health documentation describes a registry-based workaround involving the inpoutx64 driver. That is a more advanced change and can disable a driver, so ordinary users should avoid applying it casually and should prefer waiting or rolling back the optional update unless they understand the effect. 23

Will the fixes arrive with the September 8 update?

The normal improvements from the August preview release are expected to be carried into the next mandatory cumulative update, scheduled for Tuesday, September 8, 2026. However, that expectation does not amount to a Microsoft promise that every KB5120998 cursor, wallpaper, font, or disappearance symptom will be fixed on that date. 519

The safest reading is therefore straightforward: the Defender alert is a confirmed reporting problem that should be checked rather than feared, while KB5120998 is an optional update with an officially acknowledged cursor-personalization regression. Keep the two issues separate, verify Defender directly, and avoid or remove KB5120998 if its visual-customization problems affect your PC.