We use Microsoft Defender for Endpoint across our environment, and starting this morning both quick and full scans began failing. In some cases, the Defender service crashes and has to be restarted. We first noticed it while investigating a separate infection, but the problem reproduces on otherwise clean devices simply by starting a quick scan. Fresh Windows installations are affected after receiving a Defender update. Current versions are AM Engine 1.1.26070.7, product 4.18.26070.9, and antivirus and antispyware definitions 1.457.219.0. Is anyone else seeing this, and does it look like a bad definition update rather than an issue caused by the original infection?
4 Answers
One test device crashes during a quick scan, while another does not. On the affected machine, logging out can hang with “The wait operation timed out,” and Event Viewer shows repeated 30-second transaction timeouts waiting for the WinDefend service. Check the Defender Operational log, especially events 2000, 2001, and 5007, along with `Get-MpComputerStatus` to compare definition timestamps. A fleet-wide failure like this is often an acknowledged bad-signature push, so checking the endpoint security service health dashboard is worthwhile.
Try clearing the dynamic definitions and forcing a fresh signature update from an elevated command prompt: `cd %ProgramFiles%Windows Defender`, then run `MpCmdRun.exe -removedefinitions -dynamicsignatures` followed by `MpCmdRun.exe -SignatureUpdate`. Do not run the removal command without the `-dynamicsignatures` option, because that can remove the entire engine. Restarting the device afterward may also be necessary.
We’re seeing the same thing. On several endpoints, msmpeng.exe crashes during scans, which makes a faulty definition update look more likely than an isolated infection.
The issue also appears on freshly installed Windows devices after the latest Defender update. That suggests the problem is tied to the update rather than the system image.
That procedure plus a restart fixed the problem on one device. It seems consistent with a bad definition rollout, although systems using hotpatching may also be worth checking.