Windows Defender Antivirus has encountered an error trying to update signatures.

Question

Hello

I have a Server 2019 machine which is refusing to update or scan. If I try to remove updates and install new updates from powershell I get the following:

-------------------------------------------------------------------------------------

MpCmdRun: Command Line: "C:\Program Files\Windows Defender\MpCmdRun.exe" -removedefinitions -dynamicsignatures
Start Time: ‎Wed ‎Oct ‎12 ‎2022 09:02:29

MpEnsureProcessMitigationPolicy: hr = 0x1
Start: MpRemoveDefinitions(0)
ERROR: MpRollbackSignature failed with hr=800106BA
MpCmdRun: End Time: ‎Wed ‎Oct ‎12 ‎2022 09:02:29

-------------------------------------------------------------------------------------

-------------------------------------------------------------------------------------

MpCmdRun: Command Line: "C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate
Start Time: ‎Wed ‎Oct ‎12 ‎2022 09:02:53

MpEnsureProcessMitigationPolicy: hr = 0x1
Start: MpSignatureUpdate()
Calling MpUpdateStartEx with option 0x1
Update started
Update completed with hr: 0x800106ba
ERROR: Signature Update failed with hr=800106BA
MpCmdRun: End Time: ‎Wed ‎Oct ‎12 ‎2022 09:02:53

-------------------------------------------------------------------------------------

Service and Engine version are reporting as version 0.0.0.0

The Windows Defender Operational Event Logs are reporting event ID's 5007,2001

The Windows Defender ATP,Anti-Virus and Network inspection services are all set to manual and I cannot change them to automatic as the option is either greyed out or access is denied.

Any ideas on how I can resolve this?

Answer 1

Bump. Any troubleshooting tips appreciated...

Answer 2

Hello

Thank you for your question and reaching out. I can understand you are having issues related to Defender updates.

1. Run sfc /scannow
2. Run below DISM commands from elevated prompt.

DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

3. Copy, paste, and run this command at the Windows Command Prompt with elevated

“C:\Program Files\Windows Defender\MpCmdRun.exe” -SignatureUpdate

“C:\Program Files\Windows Defender\MSASCui.exe” -Update

----------------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept as answer--

Answer 3

Thanks for your reply. Unfortunately that doesn't work

Sfc /scannow reported no problems. As with the DISM commands:

C:\Windows\system32>DISM /Online /Cleanup-Image /CheckHealth

Deployment Image Servicing and Management tool
Version: 10.0.17763.3406

Image Version: 10.0.17763.3406

No component store corruption detected.
The operation completed successfully.

C:\Windows\system32>DISM /Online /Cleanup-Image /ScanHealth

Deployment Image Servicing and Management tool
Version: 10.0.17763.3406

Image Version: 10.0.17763.3406

[==========================100.0%==========================] No component store corruption detected.
The operation completed successfully.

C:\Windows\system32>DISM /Online /Cleanup-Image /RestoreHealth

Deployment Image Servicing and Management tool
Version: 10.0.17763.3406

Image Version: 10.0.17763.3406

[==========================100.0%==========================] The restore operation completed successfully.

Also

C:\Program Files\Windows Defender>.\MpCmdRun.exe -SignatureUpdate
Signature update started . . .
ERROR: Signature Update failed with hr=800106BA
CmdTool: Failed with hr = 0x800106BA. Check C:\Users\administrator\AppData\Local\Temp\MpCmdRun.log for more information

The executable MSASCui.exe does not exist on the server.

Answer 4

Well unless I can find some sort of solution, it looks like I will have to rebuild the DC, which is very annoying.

Answer 5

The same problem wit update Defender signature

========================================

Microsoft Windows [Version 10.0.22621.2215]

(c) Microsoft Corporation. Všechna práva vyhrazena.

C:\Windows\System32>cd %ProgramFiles%\Windows Defender

C:\Program Files\Windows Defender>MpCmdRun.exe -removedefinitions -dynamicsignatures

Service Version: 0.0.0.0

Engine Version: 0.0.0.0

Starting Dynamic Signature removal.Failed! Error 0x800106ba

Service Version: 0.0.0.0

Engine Version: 0.0.0.0

CmdTool: Failed with hr = 0x800106ba. Check C:\Users\admin\AppData\Local\Temp\MpCmdRun.log for more information

C:\Program Files\Windows Defender>MpCmdRun.exe -SignatureUpdate

Signature update started . . .

Service Version: 0.0.0.0

Engine Version: 0.0.0.0

ERROR: Signature Update failed with hr=0x800106ba

CmdTool: Failed with hr = 0x800106ba. Check C:\Users\admin\AppData\Local\Temp\MpCmdRun.log for more information

C:\Program Files\Windows Defender>clear

'clear' is not recognized as an internal or external command,

operable program or batch file.

C:\Program Files\Windows Defender>Run sfc /scannow

'Run' is not recognized as an internal or external command,

operable program or batch file.

C:\Program Files\Windows Defender>DISM /Online /Cleanup-Image /CheckHealth

Deployment Image Servicing and Management tool

Version: 10.0.22621.1

Image Version: 10.0.22621.2215

No component store corruption detected.

The operation completed successfully.

C:\Program Files\Windows Defender>DISM /Online /Cleanup-Image /ScanHealth

Deployment Image Servicing and Management tool

Version: 10.0.22621.1

Image Version: 10.0.22621.2215

[==========================100.0%==========================] No component store corruption detected.

The operation completed successfully.

C:\Program Files\Windows Defender>DISM /Online /Cleanup-Image /RestoreHealth

Deployment Image Servicing and Management tool

Version: 10.0.22621.1

Image Version: 10.0.22621.2215

[==========================100.0%==========================] The restore operation completed successfully.

The operation completed successfully.

C:\Program Files\Windows Defender>C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate

'C:\Program' is not recognized as an internal or external command,

operable program or batch file.

C:\Program Files\Windows Defender>"C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate

Signature update started . . .

Service Version: 0.0.0.0

Engine Version: 0.0.0.0

ERROR: Signature Update failed with hr=0x800106ba

CmdTool: Failed with hr = 0x800106ba. Check C:\Users\admin\AppData\Local\Temp\MpCmdRun.log for more information

C:\Program Files\Windows Defender>"C:\Program Files\Windows Defender\MSASCui.exe" -Update

'"C:\Program Files\Windows Defender\MSASCui.exe"' is not recognized as an internal or external command,

operable program or batch file.

C:\Program Files\Windows Defender>