Antimalware Client Version / Endpoint Protection Definition

Question

Antimalware Client Version / Endpoint Protection Definition

Duchemin, Dominique 2,011

Hello,

I noticed on the standalone machines (https://learn.microsoft.com/en-us/mem/configmgr/protect/deploy-use/endpoint-protection-configure-standalone-client) I have no update on the Endpoint Protection definition , why?

2023-07-31_15-15-06 Standlone Antimalware.jpg

The registries are good:

2023-07-31_13-54-38 Registry 01 Antimalware.jpg

The machines have access to the share. Even I ran the 3 executables manually ... no error but no update as well...

2023-07-31_15-22-43 Antimalware Share.jpg

Thanks,
Dom

0 comments

1 answer

Your answer

Answer 1

AllenLiu-MSFT 49,441 Microsoft External Staff

Hi, @Duchemin, Dominique

Thank you for posting in Microsoft Q&A forum.

You may try to set the Disable alternate sources (such as Microsoft Windows Update, Microsoft Windows Server Update Services, or UNC shares) for the initial definition update on client computers option to False. After you change this setting, the clients can download and install antimalware definition file updates immediately after installation as long as the client has access to one of the sources that hosts the files.

For your reference:

https://learn.microsoft.com/en-us/troubleshoot/mem/configmgr/endpoint-protection/antimalware-definition-files-not-updated

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Add comment".

Duchemin, Dominique 2,011 Reputation points

2023-08-01T16:17:46.9833333+00:00

Hello @AllenLiu-MSFT

Where is the "set the Disable alternate sources (such as Microsoft Windows Update, Microsoft Windows Server Update Services, or UNC shares)" this is not explained in the article?

It is a standalone machine no Configuration Manager.

Is it in the XML file? What is the name of the field? there is nothing with the word "Alternate"

if it is that oner it is already set to False!!!

<AddValue Name="DefinitionUpdateFileSharesSources" Type="REG_SZ" Disabled="false">\VRPSCCMSU01.ad\WsusContent</AddValue>

Thanks,

Dom
AllenLiu-MSFT 49,441 Reputation points Microsoft External Staff

2023-08-02T07:30:13.6333333+00:00

Hi, @Duchemin, Dominique

Sorry, it's an option of Endpoint Protection in Client Settings, but your machine is a standalone machine without client agent, it should have nothing to do with the option.

For the Definition Updates setting, try to select Updates distributed from Microsoft Update and Updates distributed from Microsoft Malware Protection Center to the first two options if your standalone client is connected to the internet.

Then change the antimalware policy settings:

https://learn.microsoft.com/en-us/mem/configmgr/protect/deploy-use/endpoint-protection-configure-standalone-client#change-antimalware-policy-settings-on-a-standalone-endpoint-protection-client
Duchemin, Dominique 2,011 Reputation points

2023-08-02T15:16:10.69+00:00

Hello @AllenLiu-MSFT

For the Definition Updates setting, try to select Updates distributed from Microsoft Update and Updates distributed from Microsoft Malware Protection Center to the first two options if your standalone client is connected to the internet.

The machine does not have internet connection it is why we are using a share UNC path...

Thanks,

Dom
AllenLiu-MSFT 49,441 Reputation points Microsoft External Staff

2023-08-03T08:36:41.27+00:00

Hi, @Duchemin, Dominique

Have we download the latest updates for Microsoft Defender Antivirus to the UNC share or install it manually?

https://www.microsoft.com/en-us/wdsi/defenderupdates

Share via

Antimalware Client Version / Endpoint Protection Definition

1 answer

Your answer