Windows Defender not updating — the definitions are days or weeks out of date, the update fails silently, or Windows Security shows update errors — is worth fixing promptly. Outdated definitions mean Defender can’t detect threats discovered since the last successful update. If you want the full context, see our Complete Guide to Fixing Windows, Browser, and Software Errors.
Try the manual update first: Windows Security → Virus and threat protection → scroll to “Virus and threat protection updates” → Check for updates. If this fails with an error code, note the code — it identifies the specific block. If it succeeds but definitions are still showing an old date: the update installed but the timestamp isn’t refreshing correctly (usually resolved by restarting the machine).
The fastest fix: command-line update
Administrator Command Prompt:
"%ProgramFiles%Windows DefenderMpCmdRun.exe" -SignatureUpdateThis updates definitions directly from Microsoft’s servers, bypassing the Windows Update delivery channel that sometimes gets stuck. If this succeeds: Defender is working, and the UI update button was using a broken update path. If this also fails: note the error output — it usually states exactly what blocked the download.
Windows Update dependency
Defender definition updates flow through Windows Update. When the Windows Update service has issues, Defender updates stop too — even though they appear independent in the UI.
Win + R → services.msc → confirm these services are Running and set to Automatic: Windows Update, Windows Update Medic Service, and BITS (Background Intelligent Transfer Service). Restart any that are stopped. After restarting: try the manual update again.
Security Intelligence Update download: alternative source
Microsoft publishes Defender definition updates directly for manual download at: microsoft.com/en-us/wdsi/defenderupdates. Download the appropriate package (64-bit for most machines → “Security Intelligence Update for Windows Defender Antivirus”) → run it as administrator. This completely bypasses the automated update mechanism and installs fresh definitions directly. Works even when Windows Update is broken.
Corrupted update cache
Administrator Command Prompt:
net stop wuauserv
net stop cryptSvc
net stop bits
rd /s /q C:WindowsSoftwareDistribution
net start wuauserv
net start cryptSvc
net start bitsThis deletes the Windows Update cache that Defender uses for its definition downloads. After restarting these services: retry the update. Windows downloads fresh update packages rather than trying to resume a corrupted download.
Third-party antivirus conflict
When a third-party antivirus (Norton, McAfee, Kaspersky, Avast, etc.) is installed: it takes over as the primary security product and Defender switches to “Passive Mode” — it doesn’t update its definitions because it’s not the active scanner. This is intentional and correct behaviour. To re-enable Defender as primary: uninstall the third-party antivirus → Defender becomes active again → definitions update normally.
If you want both products: only one can be active at a time for real-time protection. Defender in passive mode doesn’t need current definitions for its primary function.
Specific error codes
- 0x80240034: Windows Update Agent issue → run Windows Update troubleshooter
- 0x80070422: Windows Update service stopped → start it (services.msc)
- 0x8024402c: Network/proxy issue → check proxy settings, disconnect VPN
- 0x800700b7: Update conflict → clear the SoftwareDistribution cache
- 0x80240016: Already updating → wait 15 minutes and try again
Check Defender’s status properly
Windows Security shows the definition age in the UI, but it’s not always accurate when the UI itself is having problems. The authoritative check is PowerShell:
Get-MpComputerStatus | Select-Object AntivirusSignatureLastUpdated, AntivirusSignatureVersionThis shows exactly when the last successful update ran. If it’s within 24 hours: Defender is updating correctly despite what the UI suggests. If it’s days old: genuine update failure.
SFC for corrupted Defender files
If definition downloads succeed but Defender doesn’t function correctly after them:
sfc /scannowAdministrator Command Prompt. Also: Windows Security → Device security → Security processor details → Security processor troubleshooting → Clear TPM. This clears the TPM state that Defender uses for some security features — a rare fix but relevant when Defender’s error is specifically about security validation rather than definition download.
Our guide on Windows 11 not updating covers the Windows Update service issues that affect Defender updates alongside regular Windows patches. For machines where Defender is showing as completely disabled rather than just not updating, the system corruption and malware removal guides cover the deeper fix paths. Microsoft’s Defender update documentation covers the full list of update error codes, the fallback update paths, and the Microsoft Update Catalog entry for downloading definition updates directly when automated channels fail.
Network restrictions and definition download servers
Defender downloads definitions from Microsoft’s update servers. Corporate proxies and firewalls that restrict access to Microsoft’s CDN domains block these downloads. The specific domains required: update.microsoft.com, download.windowsupdate.com, wdcp.microsoft.com, and *.windowsupdate.com. If the corporate network filters these and Defender updates work fine at home but not at work: IT needs to add these domains to the proxy and firewall allowlist.
For users who can’t change corporate network settings: temporarily connecting via a personal mobile hotspot bypasses the corporate network restriction and allows Defender to update. Return to the corporate network after updating — the definitions stay current until the next required update cycle.
Metered connection delaying updates
On connections marked as metered (Settings → Network and internet → your connection → Set as metered connection), Windows delays non-critical updates — and this can affect Defender definition updates. Settings → Windows Update → Advanced options → “Download updates over metered connections” → enable this even on metered connections to ensure security updates aren’t delayed. Defender definitions are small (typically 50–200 MB) compared to full Windows updates and are worth downloading even on limited connections.
Scheduled scan and update timing
Defender updates definitions as part of its automatic maintenance cycle, which typically runs in the early hours of the morning when the machine is idle. On laptops that are shut down or disconnected from the network overnight: the maintenance cycle never runs and definitions fall behind. Settings → Windows Update → Advanced options → Automatic updates → this also covers Defender update scheduling.
For machines that are only on during business hours: manually triggering a Defender update at the start of each workday ensures definitions are current. Windows Security → Virus and threat protection updates → Check for updates takes 30 seconds and keeps Defender current regardless of the maintenance schedule.
Defender in Windows Sandbox and virtual machines
Defender behaves differently in virtualised environments. Windows Sandbox uses its own isolated Defender instance that doesn’t inherit definition updates from the host machine. Hyper-V virtual machines can either use their own Defender instance or be protected by the host — depending on configuration. If the update issue is specifically within a VM: the VM’s Defender needs to update independently, or the VM’s network configuration needs to allow access to Microsoft’s update servers through the virtual network adapter.
Using Microsoft Update Catalog for specific definition versions
When automated updates keep failing but you need a specific definition version: the Microsoft Update Catalog (catalog.update.microsoft.com) lists all Defender definition update packages. Search “Windows Defender” → filter by date → download the specific update package for the architecture → install as administrator. This is particularly useful when Defender needs a specific definition version for a specific threat — you can install the exact version that contains updated detection for that threat.
Checking update source configuration
Defender can pull updates from different sources: Windows Update (internet), Microsoft Update (internet), Windows Server Update Services (WSUS — corporate), or Unconfigured. On corporate machines: WSUS may have an update approved delay — IT must explicitly approve Defender definition updates before they reach machines, and if approval is delayed, definitions fall behind even when the network is fine.
Check: PowerShell → Get-MpPreference | Select-Object -Property SignatureScheduleTime, SignatureUpdateInterval, SignatureFallbackOrder. The SignatureFallbackOrder shows which update sources Defender tries in sequence. If WSUS is first in the fallback order but WSUS isn’t approving definitions promptly: the order can be changed to prefer Internet sources first. This is an IT-controlled setting on managed machines.
Malware actively blocking Defender updates
Some sophisticated malware specifically targets Defender’s update mechanism — blocking access to Microsoft’s update servers, disabling the Windows Update service, or corrupting definition files after they download. If Defender is failing to update alongside other unusual system behaviour: treat it as a potential malware symptom.
Boot from a Windows PE environment or a bootable antivirus rescue disk (Kaspersky Rescue Disk, Bitdefender Rescue Environment — both free) and run a full system scan from outside the running Windows instance. Malware that modifies Defender’s configuration to block updates often can’t hide from a scanner running from outside Windows. After cleaning with the rescue disk: boot into Windows, run the command-line update (MpCmdRun.exe -SignatureUpdate), and confirm definitions update successfully.
Real-time protection and update correlation
Defender real-time protection and definition updates are linked. When real-time protection is disabled (either through Windows Security settings or through malware): Defender may stop updating definitions entirely. The logic: definitions for a product that’s not actively protecting aren’t needed urgently. Re-enabling real-time protection (Windows Security → Virus and threat protection → toggle Real-time protection on) often automatically resumes the definition update schedule.
Check whether real-time protection was disabled without your action: Windows Security → Virus and threat protection → look at the “Real-time protection” status. If it shows as off and you didn’t disable it: either another security product disabled it (expected) or malware disabled it (unexpected and concerning).
Update history review
Windows Security → Virus and threat protection updates → Update history (if available) → or Windows Update history (Settings → Windows Update → Update history) → look for Defender definition updates and whether they’re showing “Failed.” The specific failure date and any associated error codes in the update history narrow the diagnosis significantly — if updates were succeeding until a specific date, something changed on that date that caused the failure.
Correlating the failure date with Windows Update history, installed software, and network configuration changes often immediately reveals the cause. A VPN installed the same day updates stopped, a corporate policy push applied the day before, or a third-party antivirus installed that week — the timing correlation is usually the most efficient path to identifying the correct fix.
Security Intelligence update frequency
Understanding how often Defender should update helps evaluate whether a problem is real. Microsoft typically releases Security Intelligence (definition) updates multiple times per day — sometimes 8–12 times in a 24-hour period during active threat periods. For a definition that was current yesterday to be 24+ hours old: one full update cycle was missed. Definitions that are 3+ days old represent multiple missed cycles and definitely indicate a problem. Definitions that are 2–3 hours old during business hours are normal — they’re between update releases.
The PowerShell command from earlier (Get-MpComputerStatus) shows both the definition version number and the last update timestamp — the combination confirms both that updates are being applied and that they’re the most recent available version, rather than just confirming a timestamp that might be from a very old definition package.
For organisations managing Defender through Microsoft Intune or Configuration Manager: Defender definition staleness appears in the Endpoint Manager console (intune.microsoft.com) under Endpoint Security → Antivirus → Windows unhealthy endpoints. Machines with outdated definitions are surfaced here at scale, and bulk remediation (forcing definition updates through policy) is more efficient than fixing machines individually. A single policy push to trigger definition updates on all affected machines takes minutes through Intune versus hours of per-machine troubleshooting.
Verifying definitions are actually current after updating
After any update attempt: Windows Security → Virus and threat protection → Virus and threat protection updates → “Security intelligence” section. Compare the version number shown against the latest published version at microsoft.com/en-us/wdsi/definitions. If they match: Defender is current. If they differ: the update didn’t fully apply — the definition version number is more reliable than the “last updated” timestamp for confirming currentness, since the timestamp can update without a new definition version being installed if Windows validated an existing version rather than installing a new one.
The practical priority order for most users: try the command-line update (MpCmdRun.exe -SignatureUpdate) first — it bypasses more potential failure points than the UI button. If that fails, download definitions directly from microsoft.com/wdsi/defenderupdates and install manually. If manual install also fails: clear the SoftwareDistribution cache. If all automated methods fail: check whether a third-party antivirus is in passive conflict, whether the machine is on a restricted network, and whether real-time protection is enabled. The manual download works in almost all cases where automated updates don’t — it’s the reliable backup that gets Defender current while the underlying update mechanism is investigated. Related: Zoom Video Not Working.
After resolving the update failure: set up a monitoring habit for Defender definition age. Windows Security → Virus and threat protection updates shows the version and date. On any machine where security matters (which is all of them), confirming this page shows a current date once per week takes 15 seconds. Catching a definition update failure early — before definitions are 7 days stale — is significantly less stressful than discovering definitions haven’t updated in a month and investigating from there. If this sounds familiar, Google Chrome Not Updating is worth a look.
