Security intelligence updates for Microsoft Defender Antivirus not getting updates N-1 on 30% clients.

Question

Hi Team,

Working in a Comanage environment where client get update from SCCM 4 hrs and microsoft cloud 4hrs

Still many are not installed with latest N-1 Day update even when reporting to Intune.

Will Triggering update manually on those selected client via SCCM help eg:

cd %ProgramFiles%\Windows Defender
MpCmdRun.exe -removedefinitions -dynamicsignatures
MpCmdRun.exe -SignatureUpdate

Is this triggering safe and it won't corrupt defender.

Also is there ny other way as signature manually pushing from intune device remote action is no full proof and takes 30 min for one push.

Pls advice if any other methods available to increase signature updation.

Answer 1

@Daniel Thanks for posting our Q&A.
For our issue, I have done some research. We can try to use CSP to push signature updation, specifies the interval (in hours) that will be used to check for signatures.

OMA-URI Path: ./Vendor/MSFT/Policy/Config/Defender/SignatureUpdateInterval
Valid values: 0-24.

Please refer to: https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-signatureupdateinterval

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.