Microsoft Malware Protection Center releases security intelligence updates (a.k.a, definition updates) every 3-4 hours to update the virus definitions. However, your system may not automatically install every security intelligence update.
Windows Update automatically installs the Defender security intelligence update once per day.
It lets you manually check for updates and install the latest definition updates as soon as they’ve been deployed via Windows Update.
Other than Windows Update, there is a periodic signature update task named “Windows Defender Update” scheduled task that updates the definitions when the system is idle. This task is part of the automatic maintenance tasks that run when the system is idle and automatically stops when user activity is detected.
This task uses the Defender command-line tool mpcmdrun.exe to update the definitions. The command-line it uses is MpCmdRun.exe SignatureUpdate -ScheduleJob.
Please note that when the Defender scheduled task (“Windows Defender Update” – periodic signature update task) or the Windows Security app updates the definitions, they won’t appear on the Windows Update history page. But every update attempt is logged into the files c:\windows\temp\MpSigStub.log and c:\windows\temp\MpCmdRun.log.You can check the security intelligence version by opening Windows Security → Virus and threat protection → Check for updates.
You can update the definitions from there, but it won’t be reflected on the WU history page.
So, typically, your system auto-updates the Defender definitions multiple times daily. However, the Windows Defender Update scheduled task doesn’t trigger if the system is idle.
You wonder how to force Defender to update every N number of hours.
Change Defender Definitions Update Frequency
The default frequency at which Defender updates its definitions should be sufficient for most users. However, if you need to increase the frequency of Microsoft Defender definition updates, use PowerShell.
Launch PowerShell as administrator. For example, to force Defender to update the definitions every 5 hours daily, run the following commands:
set-mppreference -SignatureUpdateInterval 5 set-mppreference -SignatureScheduleDay 0
You may have to restart Windows for the changes to take effect.
To revert to the Windows default settings, run:
set-mppreference -SignatureUpdateInterval 0 set-mppreference -SignatureScheduleDay 8
More Information
The “SignatureUpdateInterval” value specifies <time> as a number representing the number of hours between definition update checks. Valid values range from 1 (every hour) to 24 (once per day). If you do not specify a value for this parameter or set it to 0, Windows Defender checks at the default interval.
The “SignatureScheduleDay” value specifies the day of the week on which to check for definition updates. Alternatively, specify everyday for a scheduled scan or never. The acceptable values for this parameter are:
- 0: Everyday
- 1: Sunday
- 2: Monday
- 3: Tuesday
- 4: Wednesday
- 5: Thursday
- 6: Friday
- 7: Saturday
- 8: Never
The default value is 8, never. If you specify a value of 8 or do not specify a value, Windows Defender checks for definition updates by using a default frequency.
(For more information, check out Set-MpPreference (Defender) | Microsoft Learn)
References
Antimalware updates change log – Microsoft Security Intelligence
One small request: If you liked this post, please share this?
One "tiny" share from you would seriously help a lot with the growth of this blog. Some great suggestions:- Pin it!
- Share it to your favorite blog + Facebook, Reddit
- Tweet it!
