How to manually update Microsoft Defender

Microsoft Defender is the built-in anti-malware package that’s included with modern Windows operating systems. It’s alternatively known as Windows Security (it shows up under Settings > Privacy & security as Windows Security), Windows Defender, or Microsoft Defender Antivirus, as on this Microsoft Learn page. But whatever you want to call it, for many Windows users, this tool is the go-to default for handling security on their PCs.

As with Windows Update in general, sometimes Microsoft Defender updates may not work. Normally, Defender updates are handled as part of routine Windows update behavior, run on a daily basis as a scheduled task. But sometimes, Windows Update itself runs into problems and doesn’t do much (or anything).

Should this happen, there are numerous other ways to keep Defender updated, sidestepping any issues strictly related to Windows Update itself. (See the note at end of story for more advice on this topic.)

1. Use Microsoft Defender’s update facility via Windows Security

You can access Windows Security within Settings by typing windows security into the Start menu search box in either Windows 10 or 11. Doing so produces a direct link to that app, as shown in Figure 1.

Figure 1: The Windows Security app comes right up when you call it by name from Start.
Ed Tittel / Foundry

Once you open Windows Security, you’re presented with an array of choices to dig deeper. Click the item that reads Virus & threat protection. From the top, the third heading down in that window reads “Virus & threat protection updates,” as shown in Figure 2.

srcset='https://b2b-contenthub.com/wp-content/uploads/2025/12/update-ms-defender-02-virus-threat-protection.png?quality=50&strip=all 588w, https://b2b-contenthub.com/wp-content/uploads/2025/12/update-ms-defender-02-virus-threat-protection.png?resize=230%2C300&quality=50&strip=all 230w, https://b2b-contenthub.com/wp-content/uploads/2025/12/update-ms-defender-02-virus-threat-protection.png?resize=534%2C697&quality=50&strip=all 534w, https://b2b-contenthub.com/wp-content/uploads/2025/12/update-ms-defender-02-virus-threat-protection.png?resize=129%2C168&quality=50&strip=all 129w, https://b2b-contenthub.com/wp-content/uploads/2025/12/update-ms-defender-02-virus-threat-protection.png?resize=64%2C84&quality=50&strip=all 64w, https://b2b-contenthub.com/wp-content/uploads/2025/12/update-ms-defender-02-virus-threat-protection.png?resize=368%2C480&quality=50&strip=all 368w, https://b2b-contenthub.com/wp-content/uploads/2025/12/update-ms-defender-02-virus-threat-protection.png?resize=276%2C360&quality=50&strip=all 276w, https://b2b-contenthub.com/wp-content/uploads/2025/12/update-ms-defender-02-virus-threat-protection.png?resize=191%2C250&quality=50&strip=all 191w' width='588' height='768' sizes='auto, (max-width: 588px) 100vw, 588px'>Figure 2: Click Protection updates (blue link at bottom) to update Windows Defender in Windows 11.
Ed Tittel / Foundry

Click the Protection updates link at the bottom of that section (it reads Check for updates in Windows 10). This forces a manual update of Defender’s security definitions (also known as signatures) and software, when available. Easy-peasy.

2. Update Defender signatures in PowerShell

There’s a special PowerShell command for updating Defender signatures. The simple, basic syntax for this command is to type the command name — Update-MpSignature — in PowerShell. This command works on Windows 10 and 11 versions alike.

Although it doesn’t appear to do much inside PowerShell, the command does indeed update the Defender signatures. If you watch while it runs, it takes a while to complete, and it does report progress.

Figure 3 shows what things look like upon completion; the white diamond in the green glyph at the end of the command prompt indicates that the command complete successfully. I also ran the helpful Get-MPComputerStatus command to display the current Defender version and status, also shown in Figure 3.

Figure 3: A single PowerShell cmdlet, Update-MpSignature, does the necessary here.
Ed Tittel / Foundry

Once you’ve updated Defender’s signatures, you can easily check status by returning to the Protection updates item shown earlier in Figure 2. It provides information about last update, creation date and security intelligence version in effect. Figure 4 shows those details. (Indeed, it’s a little easier to read than the preceding Get-MPComputerStatus info shown above in Figure 3.)

srcset='https://b2b-contenthub.com/wp-content/uploads/2025/12/update-ms-defender-04-protection-updates-screen.png?quality=50&strip=all 547w, https://b2b-contenthub.com/wp-content/uploads/2025/12/update-ms-defender-04-protection-updates-screen.png?resize=300%2C225&quality=50&strip=all 300w, https://b2b-contenthub.com/wp-content/uploads/2025/12/update-ms-defender-04-protection-updates-screen.png?resize=224%2C168&quality=50&strip=all 224w, https://b2b-contenthub.com/wp-content/uploads/2025/12/update-ms-defender-04-protection-updates-screen.png?resize=112%2C84&quality=50&strip=all 112w, https://b2b-contenthub.com/wp-content/uploads/2025/12/update-ms-defender-04-protection-updates-screen.png?resize=480%2C360&quality=50&strip=all 480w, https://b2b-contenthub.com/wp-content/uploads/2025/12/update-ms-defender-04-protection-updates-screen.png?resize=334%2C250&quality=50&strip=all 334w' width='547' height='410' sizes='auto, (max-width: 547px) 100vw, 547px'>Figure 4: The “Security intelligence” item shows the version number, creation date, and update time for current signatures.
Ed Tittel / Foundry

3. Update all Defender components using DISM

Microsoft maintains a web page specifically for Defender updates entitled “Microsoft Defender update for Windows operating system installation images.” It identifies three components that make up the Defender environment, all of which are subject to periodic updates:

Platform version: signatures for a specific edition of Windows 10 or 11 (Home, Pro, Education, etc.)

Engine version: specific anti-malware engine version for Windows 10 or 11

Security intelligence version: current security intelligence updates for Defender

Because they change daily (or more often), signatures get updated all the time. But the anti-malware client (the part of Defender that coordinates checks on individual PCs) and the anti-malware engine (the part of Defender that handles defensive maneuvers and cleanups on individual PCs when malware is detected) are also subject to periodic updates. These typically happen anywhere from one to four times a month, depending on malware activity and severity.

Security intelligence updates (labeled as “Windows Intelligence Update” under the “Other Updates” heading in Windows 11 Update History listings) also occur at irregular intervals. (As I write this, the most recent one I can find is dated July 21, 2025: YMMV.)

Installing the update requires picking the appropriate platform version for your target PC(s) — namely, 32-bit, 64-bit, or ARM64. This downloads a ZIP file that includes relevant cabinet files (.cab or.msu), patching files, and a PowerShell script named DefenderUpdateWinImage.ps1.

After unpacking, the script must be applied to an offline Windows image inside an administrative Windows Terminal/PowerShell session using the following syntax:

DefenderUpdateWinImage.ps1 -WorkingDirectory [path] -Action AddUpdate -ImagePath [path_to_OS_image] -Package

Replace [path] with the actual path to the offline image to be updated, and [path_to_OS_image] with the path to the working directory for results.

4. Give Microsoft PC Manager a try

Microsoft has a new OS management tool called Microsoft PC Manager that’s available in beta test form. You can download it from the application home page or the Microsoft Store. Once you’ve installed MSPCManager.exe, you can run the application from the Start menu — typing pc man will usually bring up the app name to click on.

If you click the Protection button (upper left) and then Windows Update, it will offer Defender updates if any are available, as shown in Figure 5.

Figure 5: If PC Manager finds any Defender updates pending (shown as “Virus definitions” and “Security Intelligence…” here), click Update to apply them.
Ed Tittel / Foundry

Essentially, this provides another path to the same functionality described for Windows Security in section 1 earlier. But PC Manager does all kinds of other interesting stuff, too, including offering a wicked good Deep Cleanup tool.

Where there’s a will, there’s a way

Given the various methods to download Microsoft Defender signatures and executables, there’s always a method to bring things up to date. My advice is to let Windows Update do things automatically whenever it can. If that doesn’t work, try the Protection updates (Windows 11) or Check for updates (Windows 10) links in the Windows Security app.

And if that fails, you can turn to PowerShell to update signatures or to the Defender installation images support page. What the heck: you can give Microsoft PC Manager a go, if you’re of a mind to try it out.

Hopefully you won’t have to go that far at all, or not very often. But it’s nice to know there’s another way to update Windows Defender when one is needed.

This article was originally published in January 2022 and most recently updated in December 2025.