[Solved] Windows Defender updating through MMPC only now?

Discussion in 'Windows 10' started by pf100, Sep 15, 2018.

  1. pf100

    pf100 MDL Expert

    Oct 22, 2010
    1,183
    1,612
    60
    Fully updated 1803 Pro and LTSB 2016
    Something bad appears to have changed with the latest updates forcing Defender to update through MMPC only instead of through Microsoft update (I'm not using WSUS so I can't comment on that).

    With the Windows Update Service running, specifying updating Defender through Windows Update Service using the commands:
    Code:
    powershell.exe Update-MpSignature -UpdateSource MicrosoftUpdateServer
    
    or
    
    "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -SignatureUpdate

    uses lots of bandwith now and behaves the exact same as the commands specifying MMPC:

    Code:
    powershell.exe Update-MpSignature -UpdateSource MMPC
    
    or
    
    "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -SignatureUpdate -MMPC

    Anybody else running into this problem?
    Is there a known fix, or is this just more of Microsoft removing options again?
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  2. pf100

    pf100 MDL Expert

    Oct 22, 2010
    1,183
    1,612
    60
    Something funny is going on. Now defender is updating through the Windows Update Service again, and takes like 5 seconds to find out there is no update needed instead of downloading the same update again. Must be something on Microsoft's end.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. BAU

    BAU MDL Senior Member

    Feb 10, 2009
    307
    471
    10
    This has been happening for a long time. Cloud-based fast-reaction signatures only happen via WU, never viar MMPC, and sometimes a flag is set to invalidate existing, already downloaded and applied same build.

    Microsoft does not comment, but it makes sense to do it from time to time for maintenance reasons (because Defender is still not a very robust program - there are often reports of inability to update, and locked handles of the signature processes - hence the need for a complete cleanup.
     
  4. pf100

    pf100 MDL Expert

    Oct 22, 2010
    1,183
    1,612
    60
    I remember you briefly mentioning this to me before, but I hadn't noticed it until today and didn't understand why it would behave this way repeatedly. I was manually checking for defender updates a lot through WU today (maybe 50 times) while doing some tests and now it's obvious to me what's going on. Thanks for the explanation. It makes sense to me now.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...