Share via

Windows Defender Stopped Working When I Checked For Updates- Be Concerned or No?

Anonymous
2024-02-23T05:10:01+00:00

I accidentally switched my router off earlier and quickly rebooted it; this caused Time-Service on my Windows 10 device to freak out, and instead of synchronizing with a Microsoft Corporation database IP, my system is now synchronising with an IP associated with my isp

anyway, I was a bit on edge after this and went back to what I was doing before, which was opening Windows Security and clicking "Check For Updates"

what happened next was Windows Security suddenly told me that Defender had stopped, and to click Restart, so I did and it quickly came back online without issue. I checked the Event Viewer Windows Defender > Operational logs, but I there was just a bunch of Event ID 5007 entries, which were different than the normal events

I decided to check the Event Viewer System logs to see the WindowsUpdateClient events and noticed something that might be the cause of this brief Windows Security shutdown?

usually when updating Windows Defender, the event log says "Successfully updated: Security Intelligence Update for Microsoft Defender Antivirus"

however, the WindowsUpdateClient event that occurred when Windows Security shut down said "Successfully updated: Update for Microsoft Defender Antivirus antimalware platform"

I used the Find feature to search for these "Update for Microsoft Defender Antivirus platform" events, and I found that they are a lot sparser than the normal "Security Intelligence Update" events, with the last one occurring on Feb 6th, and the one before that occurring on November 29th

back to the Windows Defender > Operational logs, at the time of the security shutdown, there were a few events that usually occur at startup before reaching a new event that simply said:

"Microsoft Defender Antivirus platform update to (version) has succeeded"

after that were some more events that normally happen at startup, and currently everything is online and running. I restarted my PC to be sure it remained activated, which it did, and I also did a Full Scan to be sure

is this something to worry about? I don't believe Windows Security shut down on Feb 6th or November 29th when the Microsoft Defender Antivirus platform apparently did special updates. could it have been an unlucky hitch in the process that just made the AV forget to restart itself?

anyone else experience this at all? I'm mainly asking if it's a cause for concern but can't hurt to see if anyone else saw similar behavior with this 'unique' update. Windows 10 22h2

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

8 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2024-02-24T07:53:43+00:00

    Hello, HamAndHands.

    Thanks for your reply.

    If no viruses have been detected, then you don't need to worry about security issues.

    There are various types of updates, such as adding data to the virus database and updating the Windows Security Center. Not all updates will cause disruptions, and some updates can take effect immediately.

    Some updates, the Windows Security Center can update on its own, while others can only be done through Windows Update.

    Additionally, if there is an issue with the Security Center and there are no security services running on your computer, Windows will provide a security warning.

    Additionally, you can try uninstalling third-party antivirus software and test using only the Windows Security Center.

    After using it for a while, check if there are any error messages or issues with starting up and functioning properly.

    Disclaimer: After uninstalling third-party security programs, please immediately activate the Windows Security Center to avoid potential security risks.

    If there are any updates, please feel free to reply.

    Best regards.

    Malygos - MSFT | Microsoft Community Support Specialist

    1 person found this answer helpful.
    0 comments
  2. Anonymous
    2024-02-24T03:33:07+00:00

    Hello, HamAndHands.

    Welcome to Microsoft Community.

    Based on your description, it seems that you have some concerns or confusion regarding the issue of the security center shutting down and restarting.

    You have found an event with ID 5007.

    This event represents: Microsoft Defender Antivirus configuration changed. If this event is unexpected, you should review the settings as the event might be the result of malware.

    If this situation occurs, it could be due to the following reasons.

    1. You may have used certain third-party software that caused the Security Center to be disabled.
    2. The Security Center might have undergone an automatic update in the background.

    If you are concerned about malicious software, I recommend using the Security Center for a full system scan. However, please note that if Windows has security updates, it may temporarily halt and restart the Security Center. This is because certain security rules require a service restart to take effect.

    A full system scan can help eliminate any potential impact caused by malicious software.

    Feel free to share any progress or updates so that we can help you in more detail.

    Best regards.

    Malygos - MSFT | Microsoft Community Support Specialist

    1 person found this answer helpful.
    0 comments
  3. Anonymous
    2024-02-24T08:23:05+00:00

    You have Malwarebytes Anti-malware... Is that the paid edition? Then, it has realtime protection, and that may have deactivated Windows Defender. Because it's not good to have two programs witn realtime-protection - they will get into conflict.

    If only the free edition, then, it shouldn't deactivate Windows Defender,

    When installing the Malwarebytes Anti-malware, you will get it as a trial-edition with realtime protection ON for some days... You can deactivate the trial-edition, somewhere in the program - don't unfortunately remember where. (Either Settings, OR Account) But after deactivating, remember to restart the computer.

    0 comments
  4. Anonymous
    2024-02-24T08:13:01+00:00

    I mean I DID get a security warning notification, it notified me on the side of my screen. I was just already tabbed into the Security Center, so I saw the "Checking for Updates" message turn into "Windows Defender has turned off, please click to restart it" in real time. I clicked it pretty quickly and it turned back on with no issue

    this kind of update is different from the Security Intelligence Updates, since this is a Platform Update for Windows Defender, and I've combed through the System logs. there are Security Intelligence Updates every day, while Platform Updates happen sparsely

    and evidently, they have occurred with similar events in the Windows Defender > Operational logs, but this is the first time Windows Defender has actively been turned off while/immediately after updating. again, it might have been an unlucky hitch in the platform update, I'm not sure

    there was no third party active at all, MalwareBytes is never open unless I'm doing a full scan with it once every week or so. I've had both antiviruses and used them this way for over a year without issue, so I doubt they're related

    especially since I haven't seemed to have any other problems since Windows Defender shut off with the Platform Update. once I restarted it, I don't believe it's randomly deactivated since then; I've checked frequently while going about my day, and the tick has always bee green. no notifications either

    on that note, shouldn't there be a special event in the Windows Defender > Operational logs if Windows Defender gets turned off? there was no such event when it happened yesterday. it was just the update events, there were no Information or Error events that mentioned Windows Defender being shut off?

    0 comments
  5. Anonymous
    2024-02-24T04:26:03+00:00

    Event ID 5007 is very common in the Windows Defender logs, as it happens whenever there is an update; however, when Defender stopped working and I restarted it, all the event suddenly said this:

    "The description for Event (number) from source cannot be found. Either the component that raised this event is not installed on your local computer or the installation is corrupted"

    I restarted my PC and all the events went back to normal, and this message event is no longer replacing any of them

    no, I did not use third party software; I have MalwareBytes but I don't keep it open, nor does it open at startup; Defender is my main antivirus. the only applications open at the time were Event Viewer and Task Manager, as well as Windows Security of course

    I said that there was an update when this happened. I said in my post that I clicked Check For Updates in the Security Center, it went dormant for a few seconds, and then Defender stopped working.

    usually when Checking for Updates in Security Center it goes quiet/dormant for a few seconds while updating, and then the version number typically changes to signify the update was successful

    the "Update for Microsoft Defender Antivirus antimalware platform" events in the System log and the "Platform update to Version (number) has succeeded" in the Windows Defender Operational log correspond to when the shutdown happened

    I have already scanned numerous times with MalwareBytes and Windows Defender, which comes back clean. there hasn't seemed to be any further issues with Defender, even when receiving the usual Security Intelligence updates either

    I was caught off guard because I don't think Defender ever stopped working when the Platform Version was updated on Feb 6th, Nov 11th, Nov 1st, etc.

    there are events in the Windows Defender Operational log at the time of those updates that usually only happen at startup, but I definitely didn't have to restart Defender myself, nor did I ever receive a notification saying it had stopped working

    could it have just been an unlucky hitch in the update process, that caused Defender to stop working instead of just completely restarting on its own?

    0 comments