Update for Microsoft Defender antimalware platform

Summary

This article describes an antimalware platform update package for Microsoft Defender for the following operating systems:

Windows 10 (Enterprise, Pro, and Home editions)

Windows Server 2019

Windows Server 2016

Version information

Note: After a new platform version is released, support for older versions (N-2) will reduce to technical support only. Platform versions older than N-2 will no longer be supported. See Manage Windows Defender Antivirus updates and apply baselines for details.

This update changes the antimalware client version.

New version: 4.18.2103.7

Note Version 4.18.2001.10 is re-released to prevent supersedence. For more information, see Manage Windows Defender Antivirus updates and apply baselines.

How to find the client version information

Windows 10, version 1709 and later versions

Open the Microsoft Defender Security Center app, select the Settings icon, and then select About. The version number is listed under Antimalware Client Version.

Windows 10, version 1607, version 1703, and later versions

Open the Microsoft Defender app, select Help, and then select About. The version number is listed under Antimalware Client Version.

Package information

The package name is listed as Update for Microsoft Defender antimalware platform. The package size is approximately 2–3 MB.

Known issues in this update

Because of a change in the file path location in the update, many downloads are blocked when AppLocker is enabled.

To work around this issue, open Group Policy, and then change the setting to Allow for the following path:

Update information

This package includes monthly updates and fixes to the Microsoft Defender antimalware platform that is used by Microsoft Defender Antivirus in Windows 10.

Monthly updates are installed in addition to major Windows 10 releases. Both types of updates should be installed to ensure continued protection against malware and other threats.

For more information about the product versions and about how the updates work and how you can configure and manage them, see the Manage Windows Defender Antivirus updates and apply baselines topic.

File location changes

This update makes the following binary location changes.

Windows Defender Antivirus service (MsMpEng.exe)

Network Realtime Inspection service (NisSrv.exe)

Windows Defender Antivirus drivers

All third-party applications that have references to these binaries must be updated to the new locations.

How to obtain this update

This update is available from Microsoft Update and WSUS.

Restart requirement

You do not have to restart the system after you install this update.

Note Platform update 4.18.2001.10 might require a restart.

How to roll back this update

To roll back this update, use the appropriate method:

To roll back this update to the previous version, run the following command:

«%programdata%\microsoft\windows defender\platform\ \mpcmdrun.exe» -revertplatform

To roll back this update to the Inbox CAMP version, run the following command:

«%programfiles%\Windows Defender\MpCmdRun.exe» -resetplatform

References

Learn about the terminology that Microsoft uses to describe software updates.

Third-party information disclaimer

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.

Microsoft Defender update for Windows operating system installation images

Summary

The first hours of a newly installed Windows deployment can leave the system vulnerable because of a Microsoft Defender protection gap. This is because the OS installation images may contain outdated antimalware software binaries.

The devices on which these deployments are made are inadequately protected until they receive the first antimalware software update. We recommend that you regularly service OS installation images in order to update Microsoft Defender binaries and minimize this protection gap in new deployments.

This article describes antimalware update package for Microsoft Defender in the OS installation images (WIM and VHD files). This feature supports the following OS installation images:

Windows 10 (Enterprise, Pro, and Home editions)

Windows Server 2019

Windows Server 2016

Version information

After a new package version is released, support for the previous two versions will be reduced to technical support only.

Versions prior to the previous two versions will no longer be supported. For more information, see Manage Windows Defender Antivirus updates and apply baselines.

New version: 1.1.2104.1

This package updates the anti-malware client, anti-malware engine, and signature versions in the OS installation images to following versions:

Platform version: 4.18.2102.4

Engine version: 1.1.18000.5

Signature version: 1.335.232.0

Package information

The package size is approximately 96 MB.

Known issues in this update

Update information

This package includes monthly updates and fixes to the Microsoft Defender antimalware platform and engine that’s used by Microsoft Defender Antivirus in Windows 10.

This package also includes the latest security intelligence update that is available up to the date of release.

How to obtain this update

Different update packages are required for different Windows OS image architectures. Select the architecture that matches the installation image to which you will apply this update:

Microsoft Defender update for Windows Operating system installation image: 32-bit | 64-bit

Note: These links point to defender-update-kit-[x86|x64].zip. Extract this .zip file to get the Defender update package ( defender-dism-[x86|x64].cab) and an update patching tool ( DefenderUpdateWinimage.ps1) that assists the update operation for OS installation images.

Package update tool

The following prerequisites apply to running this patching tool ( DefenderUpdateWinImage.ps1):

You must be running a 64-bit Windows 10 or later OS environment that includes PowerShell 5.1 or a later version.

The Microsoft.Powershell.Security and DISM modules must be installed.

You must start PowerShell on the device by using administrator privileges.

Do not use this package to update live images because it can damage the Windows installation that Is running inside the Virtual Machine.

The DefenderUpdateWinImage.ps1 tool provides an option to remove the update. However, you may still want to keep a backup copy of images before you apply the update.

How to apply this update

PS C:\> DefenderUpdateWinImage.ps1 — WorkingDirectory

— Action AddUpdate — ImagePath

How to remove or roll back this update

PS C:\> DefenderUpdateWinImage.ps1 — WorkingDirectory

— Action RemoveUpdate — ImagePath

How to list the details of installed update

PS C:\> DefenderUpdateWinImage.ps1 — WorkingDirectory

— Action ShowUpdate — ImagePath

References

Learn about the terminology that Microsoft uses to describe software updates.

Security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware

Microsoft continually updates security intelligence in antimalware products to cover the latest threats and to constantly tweak detection logic, enhancing the ability of Microsoft Defender Antivirus and other Microsoft antimalware solutions to accurately identify threats. This security intelligence works directly with cloud-based protection to deliver fast and powerful AI-enhanced, next-generation protection.

Microsoft security intelligence updates include software that incorporates material from third parties. Third-party notices and information

Automatic updates

To help ensure your antimalware solution detects the latest threats, get updates automatically as part of Windows Update. If you are having problems with Windows Update, use the troubleshooter.

If you don’t already use Microsoft Defender Antivirus, learn how to turn it on.

Trigger an update

A manually triggered update immediately downloads and applies the latest security intelligence. This process might also address problems with automatic updates. Microsoft Defender Antivirus and other Microsoft antimalware solutions provide a way to manually trigger an update.

In Windows 10, select Check for updates in the Windows Security Virus & threat protection screen to check for the latest updates.

Enterprise administrators can also push updates to devices in their network. To clear the current cache and trigger an update, use a batch script that runs the following commands as an administrator:

Manually download the update

You can manually download the latest update.

Latest security intelligence update

The latest security intelligence update is:

• Version: 1.335.1079.0
• Engine Version: 1.1.18000.5
• Platform Version: 4.18.2103.7
• Released: 4/17/2021 6:41:46 PM
• Documentation: Release notes

You need to download different security intelligence files for different products and platforms. Select the version that matches your Windows operating system or the environment where you will apply the update.

Note: Starting on Monday October 21, 2019, the Security intelligence update packages will be SHA2 signed.
Please make sure you have the necessary update installed to support SHA2 signing, see 2019 SHA-2 Code Signing Support requirement for Windows and WSUS.

Antimalware solution	Definition version
Microsoft Defender Antivirus for Windows 10 and Windows 8.1	32-bit | 64-bit | ARM
Microsoft Security Essentials	32-bit | 64-bit
Windows Defender in Windows 7 and Windows Vista	32-bit | 64-bit
Microsoft Diagnostics and Recovery Toolset (DaRT)	32-bit | 64-bit
System Center 2012 Configuration Manager	32-bit | 64-bit
System Center 2012 Endpoint Protection	32-bit | 64-bit
Windows Intune	32-bit | 64-bit

The links point to an executable file named mpam-fe.exe , mpam-feX64.exe , or mpas-fe.exe (used by older antispyware solutions). Simply launch the file to manually install the latest security intelligence.

End of life for Microsoft Forefront Client Security was on July 14, 2015. Customers are encouraged to migrate to System Center Endpoint Protection. For more information, visit the Microsoft support lifecycle website.

Network Inspection System updates

The following products leverage Network Inspection System (NIS) updates:

• Microsoft Security Essentials
• Forefront Endpoint Protection
• System Center 2012 Endpoint Protection

These updates are designed to protect you from network threats, including exploits as they are transmitted. Check the version of the Antimalware Client component on your security software and download the right version of the NIS updates for your platform.

How to update Windows Defender manually in Windows 10

Windows Defender in Windows 10 or Windows 8.1 is set to automatically download and install the definition updates using Windows Update, once a day. If for some reason, your Windows Defender will not update automatically, or if you wish to download and save the definition updates in order to maybe update Windows Defender offline, on different installations of Windows 10/8/7/Vista, then this post will be of interest to you.

We have already seen how to download Windows Update manually. Today, we will see how you can update Windows Defender manually in Windows 10, Windows 8.1 and Windows 7. I will also give links for downloading updates for Microsoft Security Essentials in the post.

Update Windows Defender manually

First, check whether you are using a 32-bit or 64-bit version of Windows 10/8.1/7. Once you know the version of Windows installed on your device, download the installers from the following links:

• Download definition updates for Windows Defender in Windows 10, Windows 8.1/8: 32-bit | 64-bit | ARM.
• Download definition updates for Windows Defender in Windows 7 and Windows Vista: 32-bit | 64-bit.
• Download definition updates for Microsoft Security Essentials: 32-bit | 64-bit.

Once the file has finished downloading, go to your download location and double-click the file mpam – fe .exe . Follow the prompts to install the update.

If you think some malware is preventing the installation of Windows Defender definition updates, you may want to run a scan with Microsoft Safety Scanner or for more stubborn malware, using Windows Defender Offline.

Date: December 25, 2019 Tags: Windows Defender

Manually Updating Windows Defender?

I’ve had two blue screen errors recently with the stop code «IRQL NOT LESS OR EQUAL.» I was told that this was related to Windows Defender and that it may need an update, or may need to be reinstalled. However, when I try to check for updates, what has happened multiple times is that it says there is a Windows Defender update, begins to load, but then stops at 0% and instead goes back to saying that I am up to date.

I don’t know how to reinstall Windows Defender either, if I were to uninstall it in the first place, so I’m not sure what to do.

Replies (11) 

* Please try a lower page number.

* Please enter only numbers.

* Please try a lower page number.

* Please enter only numbers.

My name is Aracely, I am an Independent Advisor. I would love to help you today.

Try updating Windows Defender manually.

Let me know if the information has been helpful in solving your problem.

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Thanks for offering your help with the issue. I downloaded the 64bit file as instructed, but I’m not sure what to do next? I tried to open the file and nothing has happened that indicates an update went through.

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Check this link, I hope it helps.

Note: This is a non-Microsoft website. The page appears to be providing accurate, safe information. Watch out for ads on the site that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the site before you decide to download and install it.

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

I recommend you repair Windows completely before you should make a copy of your files.

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

You can use the System File Checker tool to repair damaged system files.

Follow these steps:
Press the Windows + X keys and select Symbol of the System (Administrator) or Windows PowerShell (Administrator), in the window that will open, you must type the commands in their respective order:

• DISM.exe /Online /Cleanup-image /Scanhealth
• DISM.exe /Online /Cleanup-image /Restorehealth
• DISM.exe /online /cleanup-image /startcomponentcleanup
• sfc /scannow

Each of these actions may take a few minutes, so it is important to execute one at a time. At the end, you must restart the PC.

Check this link:

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.