[Windows Client] Antivirus Posture Check Fails While Microsoft Defender Is Enabled

Last updated: October 30, 2026

Applicable to

  • Twingate Component: Client

  • Platform OS: Windows 11 and Windows 10 (all supported versions), Windows Server

Overview

The Antivirus device posture check reports antivirus as not enabled while Microsoft Defender is enabled and running normally.

This was a confirmed Microsoft issue, published on the Windows release health pages as Incorrect notifications that "Microsoft Defender Antivirus is turned off".

Microsoft has fixed it. The fix shipped in Microsoft Defender Antivirus platform version 4.18.26080.4, released September 17, 2026. Microsoft marked the advisory Resolved on September 30, 2026.

Microsoft attributes the behavior to Defender antivirus platform version 4.18.26070.9, released August 5, 2026. Devices running a platform version between 4.18.26070.9 and 4.18.26080.4 are the ones that can be affected. It is not caused by a Windows security update and is not tied to a specific Windows build.

If you are seeing this now, the fix is to bring Microsoft Defender up to date. See Resolution below.

Symptoms

  • The Antivirus posture check fails in the Client or Admin Console.

  • Users are blocked with Device security not met, or see Block reason: Verified device in Resource access events.

  • Microsoft Defender is enabled, with real-time protection on and signatures up to date.

  • Windows may also display notifications claiming Microsoft Defender Antivirus is turned off.

  • The failure persists across sign-outs and Twingate Client reinstalls.

  • Updating the Twingate Client does not resolve it. The behavior is independent of Client version.

  • Across a fleet, the set of affected devices can change from one day to the next, so a device that was compliant yesterday may not be today.

Cause

The Antivirus posture check reports antivirus state as confirmed by the Windows Security Center (WSC).

On impacted devices, WSC misreports antivirus status when the Security Center service starts, and then retains that incorrect value for as long as the service keeps running. Nothing on the device causes it to re-evaluate, so the wrong value persists until the service restarts or the state is changed manually.

Microsoft Defender is unaffected and continues to protect the device throughout. The Twingate Client reads the value WSC publishes, so the check continues to fail until WSC is made to re-evaluate.

Because the incorrect value is sampled when the service starts, a given device may or may not be affected after any particular restart. That is why the problem looks intermittent, and why it can appear to clear on its own.

Why other antivirus checks still look healthy

Checks such as Get-MpComputerStatus, the root\SecurityCenter2 WMI class, and the Windows Security app read a different source than the posture check does. These commonly report Defender as healthy on an affected device, because they are not reading the value WSC is publishing to applications.

A disagreement between those tools and Twingate is expected on an affected device and does not indicate a problem with the Client.

Resolution

Update Microsoft Defender.

The fix is in Microsoft Defender Antivirus platform version 4.18.26080.4 or later. Devices pick this up through their normal Defender update channel. No Twingate change and no Twingate Client upgrade is required.

To check the version currently on a device, run the following in PowerShell:

Get-MpComputerStatus | Select-Object AMProductVersion, AMEngineVersion

Compare AMProductVersion against 4.18.26080.4. A device below that version can still be affected. A device at or above it has the fix.

Microsoft's current platform releases are listed on the Microsoft Defender for Endpoint release notes page.

If a device is still blocked and cannot be updated yet

Changing the antivirus state by hand prompts Windows Security Center to re-evaluate, which has cleared the check for some customers:

  1. Open Windows Security > Virus & threat protection > Manage settings.

  2. Switch Real-time protection off, then back on.

Real-time protection is briefly disabled while you do this.

This is a stopgap rather than a fix, and results have been mixed. Any corrected state only holds until the Security Center service next starts, so the check can fail again after a reboot. Updating Defender is what resolves it permanently.

If many devices are affected

Roll the Defender platform update out across the fleet through your existing Defender or endpoint management update channel, rather than toggling Real-time protection device by device. The toggle is per-device and does not survive a reboot, so it does not scale.

Removing the Antivirus requirement from the affected Device Security Policy will restore access immediately, but it drops that check for every device on the policy. Treat it as a last resort while the Defender update rolls out, and re-enable it once devices are on 4.18.26080.4 or later.

A note on earlier guidance

While this issue was open, Microsoft's advisory indicated the behavior appeared after the latest Defender updates were installed, and updating Defender was not a fix. That changed when 4.18.26080.4 shipped on September 17, 2026. Updating Defender is now the correct action.