{"id":10988,"date":"2025-07-15T17:00:57","date_gmt":"2025-07-15T17:00:57","guid":{"rendered":"https:\/\/cheapwindowsvps.com\/blog\/how-to-fix-microsoft-defender-not-updating-automatically-in-windows\/"},"modified":"2025-07-15T17:00:57","modified_gmt":"2025-07-15T17:00:57","slug":"how-to-fix-microsoft-defender-not-updating-automatically-in-windows","status":"publish","type":"post","link":"https:\/\/cheapwindowsvps.com\/blog\/how-to-fix-microsoft-defender-not-updating-automatically-in-windows\/","title":{"rendered":"How to Fix Microsoft Defender Not Updating Automatically in Windows"},"content":{"rendered":"

When Microsoft Defender Antivirus is not updating automatically, you need to follow some diagnostic and troubleshooting steps to resolve the issue. Windows 10 and 11 utilize two primary mechanisms for updating Microsoft Defender: through Windows Update and directly via the Defender engine.<\/p>\n

Mechanisms for Updates<\/h3>\n
    \n
  1. Windows Update<\/strong>: Updates are downloaded and installed through Windows Update. You can view the update history in the Windows Control Panel by searching for the Security Intelligence Update (KB2267602), which is essential for both definitions and engine updates.<\/li>\n
  2. Defender Engine<\/strong>: The Defender engine also regularly checks for new antivirus signature updates from Microsoft servers.<\/li>\n<\/ol>\n

    In cases where updates fail to download or install, you might encounter specific error codes such as 80072f8f<\/code> or 0x80072ee2<\/code>. Before proceeding, ensure that your internet connection is stable and check your Windows Update policy settings. If necessary, resetting the Windows Update service can help with updates.<\/p>\n

    Checking Last Update and Settings<\/h3>\n

    To determine when Defender was last updated, you can run the PowerShell command:<\/p>\n

    Get-MpComputerStatus | Select-Object AntivirusSignatureLastUpdated, AntivirusSignatureVersion | fl<\/code><\/pre>\n
    Access the Windows Security app via the Settings app or with the command ms-settings:windowsdefender<\/code>. The app provides the last update version and time under the Virus and Threat Protection Updates section.<\/p>\n
    If there\u2019s an error indicating \u201cProtection definition update failed (800704C6)\u201d, troubleshooting steps should be pursued.<\/p>\n
    Diagnostic Steps<\/h3>\n
    To troubleshoot Defender update issues, you can follow these checks:<\/p>\n
      \n
    1. \n
      Verify Configuration<\/strong>: Ensure the update task frequency parameters are set correctly:<\/p>\n
      Get-MpPreference | Select-Object SignatureScheduleDay, SignatureScheduleTime<\/code><\/pre>\n<\/li>\n
    2. \n
      Check Services<\/strong>: Verify that Microsoft Defender is running and not disabled:<\/p>\n
      get-service WdNisSvc, WinDefend, wscsvc | select name,status,starttype<\/code><\/pre>\n<\/li>\n
    3. \n
      Manual Update<\/strong>: Try to manually update the definitions:<\/p>\n
      "%ProgramFiles%Windows DefenderMpCmdRun.exe" -SignatureUpdate<\/code><\/pre>\n<\/li>\n<\/ol>\n
      If issues persist, checking the update logs can be insightful. The update failure reason is typically logged in the %userprofile%AppDataLocalTempMpCmdRun.log<\/code> file.<\/p>\n
      Connectivity Issues<\/h3>\n
      If you receive an error like 0x8024401B<\/code>, it may indicate connectivity issues. You can check if you can reach Microsoft Update servers using the following command:<\/p>\n
      tnc fe2cr.update.microsoft.com -port 443<\/code><\/pre>\n
      Adjust your proxy settings if necessary:<\/p>\n
      netsh winhttp show proxynetsh winhttp reset proxy<\/code><\/pre>\n
      Sometimes updating with corrupt databases can lead to problems. You can reset the antivirus definitions with:<\/p>\n
      "%ProgramFiles%Windows DefenderMpCmdRun.exe" -removedefinitions -all<\/code><\/pre>\n
      Then update the definitions again with:<\/p>\n
      Update-MpSignature -Verbose<\/code><\/pre>\n
      Group Policy Configuration<\/h3>\n
      Group Policy settings could also interfere with updates. Run rsop.msc<\/code> to see any applied GPOs related to Defender. Modify or reset them if necessary to ensure there are no conflicts.<\/p>\n
      Event Logs<\/h3>\n
      Using Event Viewer can help you diagnose problems:<\/p>\n