KB4052623: Microsoft Defender antimalware platform update

Platform vs definitions, the support window and why it reappears

Think of Defender as three layers: signatures (KB2267602) are the data, the engine applies them, and the platform is the program that runs everything: the WinDefend service, the WdFilter.sys file-system filter driver and MpCmdRun.exe. KB4052623 replaces that program, not the data. Each version installs side by side in its own folder under %ProgramData%\Microsoft\Windows Defender\Platform, and the service switches to the newest folder. This is why an old folder can stay on disk and why a new platform may wait for a restart or for monitoring services to stop.

Microsoft fully supports only the current platform release (N) and gives technical upgrade support for the two before it (N-2). A PC that skips several monthly platforms falls out of that window, even if its signatures are current.

The KB reappears for two reasons: a new platform version ships every month, and each ships in waves (Beta, Preview, Staged, Broad, Delayed). Windows can therefore see several revisions in a month, all under KB4052623.

Check your platform version and rollout ring

Running MpCmdRun.exe -SignatureUpdate only updates KB2267602 definitions—the KB4052623 platform binary arrives via Windows Update, WSUS, Configuration Manager, or the Microsoft Update Catalog. Check AMProductVersion and the installed platform folders in PowerShell:

# Check active platform version (AMProductVersion) and installed platform folders> Get-MpComputerStatus | Select-Object AMProductVersion, AMServiceVersion, AMEngineVersion> Get-ChildItem "$env:ProgramData\Microsoft\Windows Defender\Platform" -Directory | Select-Object Name, LastWriteTime

To inspect which gradual rollout ring this machine follows (Beta, Preview, Staged, Broad, or Delayed):

# Inspect gradual rollout channels for Platform, Engine, and Definitions> Get-MpPreference | Select-Object PlatformUpdatesChannel, EngineUpdatesChannel, DefinitionUpdatesChannel, DisableGradualRelease

Recent platform versions & highlights

For administrators (WSUS phases, DLP deferral & rollback)

• Multiple WSUS packages in the same month: Because Microsoft ships KB4052623 in phased waves, WSUS and Configuration Manager can synchronize more than one revision per month.
• Why installation can stay pending: If Endpoint Data Loss Prevention (DLP) or Device Control is monitoring active processes, Windows may defer switching to the new platform folder until the next restart or until those services stop.
• Manual deployment prerequisite: On older OS images, ensure platform 4.18.2001.10 or later is installed before applying the latest KB4052623 package.
• Defender for Endpoint EDR sensor: The MDE sensor (MSSense) updates separately under KB5005292.
• Platform rollback: If a new platform release causes a regression on a pilot ring, roll back to the previous platform folder from an elevated Command Prompt:

:: Roll back to the previous platform version in ProgramData> "%ProgramData%\Microsoft\Windows Defender\Platform\<version>\MpCmdRun.exe" -RevertPlatform