Skip to the content
The Update Bureau
Recurring update — KB2267602: Microsoft Defender security intelligence update
Other recurring updates · Permanent KB numbers Microsoft reuses every release All in Guides →
KB890830 Monthly Malicious Software Removal Tool KB2267602 Viewing Defender security intelligence KB4052623 Monthly Defender antimalware platform KB5007651 As needed Windows Security app KB4023057 Periodic Update Health Tools KB5001716 Periodic WU service components
Windows 11, 10 & Server Microsoft Defender Recurring update
Daily · Multiple releases Automatic · No restart

KB2267602 Reused KB

KB2267602: Microsoft Defender security intelligence update

The threat definitions (virus signatures) that Microsoft Defender Antivirus uses to recognize new malware, refreshed several times a day and installed silently. Microsoft reuses KB2267602 for every package (only the version increments, such as 1.461.202.0), so dozens of entries in your update history are normal.

Force update
Update-MpSignature
CLI tool
%ProgramFiles%\Windows Defender\MpCmdRun.exe
Event IDs
2000 updated · 2001 failed · 2004 reverted
Cadence
Several times a day
Applies to
Windows 11, 10 & Server
WSUS class
Definition Updates
Restart
Never required

How signatures and the engine are delivered, and why the KB keeps repeating

Defender recognizes threats by matching files and behavior against a database of signatures, and new malware appears all day. For that reason Microsoft publishes the database as small incremental packages several times a day instead of waiting for a monthly release. Each package is a new revision with a higher version number (1.4xx.x.0) but the same KB, so the update history fills with KB2267602 lines and no older one is ever "replaced" by a new KB.

Once a month the same KB also carries the scanning engine (1.1.YYMM0.x), the code that applies the signatures. It is versioned with the month, like the platform in KB4052623. Splitting Defender across three permanent KBs lets daily signatures flow without waiting for program updates:

Component What it updates Cadence Recurring KB
Security intelligence & engine Threat signatures (1.4xx.x.0) + scanning engine (1.1.YYMM0.x) Several times a day KB2267602 (this page)
Antimalware platform Core Defender service & filter drivers (4.18.YYMM0.x) Monthly (phased) KB4052623
Windows Security app Dashboard UI & Microsoft.SecHealthUI on Windows 11 As needed KB5007651

Check your signature version or force an update

Inspect your active signature version (AntivirusSignatureVersion), scanning engine, platform version, and last update timestamp in PowerShell, and compare with Microsoft's live security intelligence release page:

PowerShell
# Check active signature (KB2267602), engine, and platform (KB4052623) versions> Get-MpComputerStatus | Select-Object AMProductVersion, AMEngineVersion, AntivirusSignatureVersion, AntivirusSignatureLastUpdated, AMRunningMode

To trigger an immediate signature update from an elevated PowerShell session (or in Windows Security › Virus & threat protection › Protection updates):

PowerShell
# Force an immediate security intelligence update> Update-MpSignature# Or pull directly from the Microsoft Malware Protection Center (bypassing WSUS)> Update-MpSignature -UpdateSource MMPC

Common error codes (0x80240016, 0x8024402C, 0x80070643)

Error code Meaning Recommended fix
0x80240016 WU_E_INSTALL_NOT_ALLOWED — Another update is installing or a reboot is pending Complete any pending restart, then run Update-MpSignature.
0x8024402C WU_E_PT_WINHTTP_NAME_NOT_RESOLVED — Proxy or DNS resolution failed Verify proxy/firewall rules or run Update-MpSignature -UpdateSource MMPC.
0x80070643 Generic installation error (corrupted cached signature delta) Clear cached dynamic signatures with MpCmdRun.exe below, or see How to fix update errors.

For administrators (WSUS, passive mode & rollback)

  • Third-party antivirus & passive mode: When Defender runs in passive mode alongside a third-party AV/EDR, Windows still receives KB2267602 so periodic scanning and EDR telemetry stay current.
  • WSUS & Configuration Manager: Classified under Definition Updates; System Center Endpoint Protection (SCEP) clients use KB2461484 instead. Configure automated supersedence cleanup so daily revisions do not bloat SUSDB.
  • Event Viewer IDs: Under Applications and Services Logs › Microsoft › Windows › Windows Defender › Operational: Event ID 2000 (signature updated), 2001 (signature failed), 2002 (engine updated), 2003 (engine failed), 2004 (reverted to last known good definitions).
  • Reset corrupted definitions or roll back:
Command Prompt (Admin)
:: Clear dynamic signatures and pull a fresh full definition set> "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -DynamicSignatures> "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -SignatureUpdate:: Full rollback to previous definitions if a new signature causes false positives> "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Official Microsoft reference Microsoft Defender Antivirus security intelligence and product updates

Edited by the site editor. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake