We use Microsoft Defender for Endpoint across our environment, and starting this morning both quick and full scans have been failing. On some devices, the Defender service crashes or needs to be restarted afterward. We first noticed it while investigating a separate infection, but the problem can also be reproduced on otherwise clean devices simply by starting a quick scan. New Windows installations are affected too, apparently after receiving a Defender update. Current versions are AM engine 1.1.26070.7, product 4.18.26070.9, and antivirus and antispyware signatures 1.457.219.0. Is anyone else seeing this, and does it look like a faulty definition update rather than an infection-related problem?
3 Answers
Yes, we’re seeing the same behavior. The Defender service crashes during scans on several endpoints, including freshly installed systems. It looks much more like a bad definition or engine rollout than a problem caused by the original infection.
For one affected machine, clearing the dynamic definitions and forcing a fresh update fixed the scan issue after a restart. From an elevated command prompt, run `MpCmdRun.exe -removedefinitions -dynamicsignatures`, followed by `MpCmdRun.exe -SignatureUpdate`. Be careful not to run the removal command without the dynamic-signatures parameter, since that can remove more than intended.
Check the Defender Operational event log and look for repeated service timeouts or crashes. One device reported a 30-second timeout waiting for the WinDefend service, and scans could leave the system hanging during logout or lock operations. It may also be worth checking the Defender health status and definition timestamps across the affected machines.
That worked on one of our test devices too, especially after restarting the machine. We’re checking whether the same definition rollout is responsible across the rest of the fleet.