Windows Defender Antivirus has encountered an error trying to update signatures.

Question

Windows Defender Antivirus has encountered an error trying to update signatures.

SpaceCaptain87 6

Hello

I have a Server 2019 machine which is refusing to update or scan. If I try to remove updates and install new updates from powershell I get the following:

-------------------------------------------------------------------------------------

MpCmdRun: Command Line: "C:\Program Files\Windows Defender\MpCmdRun.exe" -removedefinitions -dynamicsignatures
Start Time: ‎Wed ‎Oct ‎12 ‎2022 09:02:29

MpEnsureProcessMitigationPolicy: hr = 0x1
Start: MpRemoveDefinitions(0)
ERROR: MpRollbackSignature failed with hr=800106BA
MpCmdRun: End Time: ‎Wed ‎Oct ‎12 ‎2022 09:02:29

-------------------------------------------------------------------------------------

MpCmdRun: Command Line: "C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate
Start Time: ‎Wed ‎Oct ‎12 ‎2022 09:02:53

MpEnsureProcessMitigationPolicy: hr = 0x1
Start: MpSignatureUpdate()
Calling MpUpdateStartEx with option 0x1
Update started
Update completed with hr: 0x800106ba
ERROR: Signature Update failed with hr=800106BA
MpCmdRun: End Time: ‎Wed ‎Oct ‎12 ‎2022 09:02:53

-------------------------------------------------------------------------------------

Service and Engine version are reporting as version 0.0.0.0

The Windows Defender Operational Event Logs are reporting event ID's 5007,2001

The Windows Defender ATP,Anti-Virus and Network inspection services are all set to manual and I cannot change them to automatic as the option is either greyed out or access is denied.

Any ideas on how I can resolve this?

SpaceCaptain87 6 Reputation points

2022-10-16T19:47:41.527+00:00

Bump. Any troubleshooting tips appreciated...

1 answer

Your answer

SpaceCaptain87 6 Reputation points

2022-10-16T19:47:41.527+00:00

Bump. Any troubleshooting tips appreciated...

Answer 1

Limitless Technology 45,231

Hello

Thank you for your question and reaching out. I can understand you are having issues related to Defender updates.

Run sfc /scannow
Run below DISM commands from elevated prompt.

DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

Copy, paste, and run this command at the Windows Command Prompt with elevated

“C:\Program Files\Windows Defender\MpCmdRun.exe” -SignatureUpdate

“C:\Program Files\Windows Defender\MSASCui.exe” -Update

----------------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept as answer--

SpaceCaptain87 6 Reputation points

2022-10-18T20:33:54.957+00:00

Thanks for your reply. Unfortunately that doesn't work

Sfc /scannow reported no problems. As with the DISM commands:

C:\Windows\system32>DISM /Online /Cleanup-Image /CheckHealth

Deployment Image Servicing and Management tool
Version: 10.0.17763.3406

Image Version: 10.0.17763.3406

No component store corruption detected.
The operation completed successfully.

C:\Windows\system32>DISM /Online /Cleanup-Image /ScanHealth

Deployment Image Servicing and Management tool
Version: 10.0.17763.3406

Image Version: 10.0.17763.3406

[==========================100.0%==========================] No component store corruption detected.
The operation completed successfully.

C:\Windows\system32>DISM /Online /Cleanup-Image /RestoreHealth

Deployment Image Servicing and Management tool
Version: 10.0.17763.3406

Image Version: 10.0.17763.3406

[==========================100.0%==========================] The restore operation completed successfully.

Also

C:\Program Files\Windows Defender>.\MpCmdRun.exe -SignatureUpdate
Signature update started . . .
ERROR: Signature Update failed with hr=800106BA
CmdTool: Failed with hr = 0x800106BA. Check C:\Users\administrator\AppData\Local\Temp\MpCmdRun.log for more information

The executable MSASCui.exe does not exist on the server.
SpaceCaptain87 6 Reputation points

2022-11-02T20:23:34.227+00:00

Well unless I can find some sort of solution, it looks like I will have to rebuild the DC, which is very annoying.
JardaB 20 Reputation points

2023-08-29T16:36:49.9466667+00:00

The same problem wit update Defender signature

========================================

Microsoft Windows [Version 10.0.22621.2215]

(c) Microsoft Corporation. Všechna práva vyhrazena.

C:\Windows\System32>cd %ProgramFiles%\Windows Defender

C:\Program Files\Windows Defender>MpCmdRun.exe -removedefinitions -dynamicsignatures

Service Version: 0.0.0.0

Engine Version: 0.0.0.0

Starting Dynamic Signature removal.Failed! Error 0x800106ba

Service Version: 0.0.0.0

Engine Version: 0.0.0.0

CmdTool: Failed with hr = 0x800106ba. Check C:\Users\admin\AppData\Local\Temp\MpCmdRun.log for more information

C:\Program Files\Windows Defender>MpCmdRun.exe -SignatureUpdate

Signature update started . . .

Service Version: 0.0.0.0

Engine Version: 0.0.0.0

ERROR: Signature Update failed with hr=0x800106ba

CmdTool: Failed with hr = 0x800106ba. Check C:\Users\admin\AppData\Local\Temp\MpCmdRun.log for more information

C:\Program Files\Windows Defender>clear

'clear' is not recognized as an internal or external command,

operable program or batch file.

C:\Program Files\Windows Defender>Run sfc /scannow

'Run' is not recognized as an internal or external command,

operable program or batch file.

C:\Program Files\Windows Defender>DISM /Online /Cleanup-Image /CheckHealth

Deployment Image Servicing and Management tool

Version: 10.0.22621.1

Image Version: 10.0.22621.2215

No component store corruption detected.

The operation completed successfully.

C:\Program Files\Windows Defender>DISM /Online /Cleanup-Image /ScanHealth

Deployment Image Servicing and Management tool

Version: 10.0.22621.1

Image Version: 10.0.22621.2215

[==========================100.0%==========================] No component store corruption detected.

The operation completed successfully.

C:\Program Files\Windows Defender>DISM /Online /Cleanup-Image /RestoreHealth

Deployment Image Servicing and Management tool

Version: 10.0.22621.1

Image Version: 10.0.22621.2215

[==========================100.0%==========================] The restore operation completed successfully.

The operation completed successfully.

C:\Program Files\Windows Defender>C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate

'C:\Program' is not recognized as an internal or external command,

operable program or batch file.

C:\Program Files\Windows Defender>"C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate

Signature update started . . .

Service Version: 0.0.0.0

Engine Version: 0.0.0.0

ERROR: Signature Update failed with hr=0x800106ba

CmdTool: Failed with hr = 0x800106ba. Check C:\Users\admin\AppData\Local\Temp\MpCmdRun.log for more information

C:\Program Files\Windows Defender>"C:\Program Files\Windows Defender\MSASCui.exe" -Update

'"C:\Program Files\Windows Defender\MSASCui.exe"' is not recognized as an internal or external command,

operable program or batch file.

C:\Program Files\Windows Defender>
Eugenio Mariotto 0 Reputation points

2026-04-07T18:54:17.5533333+00:00

I strill have the same problem:

C:\Program Files\Windows Defender>"C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate

Signature update started . . .

Service Version: 0.0.0.0

Engine Version: 0.0.0.0

ERROR: Signature Update failed with hr=0x800106ba

CmdTool: Failed with hr = 0x800106ba. Check C:\Users\mario\AppData\Local\Temp\MpCmdRun.log for more information

Share via

Windows Defender Antivirus has encountered an error trying to update signatures.

1 answer

Your answer