How to fix won't install - Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.447.102.0) - Current Channel (Broad)

Question

Windows Update won't install - Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.447.102.0) - Current Channel (Broad)

Answer 1

Hello **Joyce C,
**The latest Security Intelligence update version is 1.447.121.0. Since the version you’re seeing (1.447.102.0) is older, it may already be superseded by a newer definition update.

You can verify the currently installed version and the last update time by running the following command:

Get-MpComputerStatus | select AntivirusSignatureVersion,AntivirusSignatureLastUpdated

Also, how these updates are deployed (for example, via Windows Update, WSUS, or manual installation) can significantly impact troubleshooting.

As a next step, you may want to manually update the Defender definitions to ensure the latest security intelligence is applied.

Refer to: Latest security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalwa…

Also, refer to: Microsoft Defender Antivirus security intelligence and product updates - Microsoft Defender for End…

If you are facing issues with Windows updates in general, refer to:  Windows Update Troubleshooter - Microsoft Support

Hope this helps!

If you found the information above helpful, please Click Yes. This will assist others in the community who encounter a similar issue, enabling them to quickly find the solution and benefit from the guidance provided.

Answer 2

Follow these steps to fix the failed Security Intelligence Update for Microsoft Defender Antivirus (KB2267602):

1. Confirm Defender is active and can update

• Ensure Microsoft Defender Antivirus is the primary antivirus. If a third‑party AV that integrates with Windows Security Center is active, Defender is disabled and its updates will fail.
• If Defender is primary, try a manual update from the Windows Security app:
  1. Open Windows Security from Start.
  2. Select Virus & threat protection.
  3. Select Virus & threat protection updates.
  4. Select Check for updates and confirm whether the security intelligence version updates successfully.

2. Try manual security intelligence installation

• Manually download and install the latest security intelligence package from https://www.microsoft.com/wdsi/defenderupdates.
• If this installs successfully, the issue is likely with the normal update channel (Windows Update, WSUS, or file share), not with Defender itself.

3. Force an update using MpCmdRun
4. Open an elevated Command Prompt (Run as administrator).
5. Change to the Defender platform folder as described in the documentation (the command in the doc automatically switches to %ProgramData%\\Microsoft\\Windows Defender\\Platform\\<antimalware platform version> or %ProgramFiles%\\Microsoft Defender).
6. Run one of:

      MpCmdRun.exe -SignatureUpdate
      MpCmdRun.exe -SignatureUpdate -MMPC
   

   • If these succeed, the engine and security intelligence can update, and the problem is likely with the configured update source (WSUS, UNC share, or Windows Update policy).
7. Check update source configuration (WSUS/UNC/Windows Update) If updates still fail, check for common causes described in the troubleshooting guidance:

• If using WSUS/SUP:
  • Verify the WSUS server has Security intelligence updates for MDAV (KB2267602) approved for the affected devices.
  • Check the fallback order for security intelligence updates; if it points to a WSUS server without approved Defender updates, the update will fail.
  • Confirm HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\WUServer points to the correct WSUS and that server is healthy.
• If using a UNC file share as a source:
  • Confirm the share path is valid and up to date; a stale or unreachable UNC share will cause failures.
• If relying on Windows Update/Microsoft Update:
  • Ensure the Windows Update service is running and troubleshoot any Windows Update issues using the guidance in the linked Windows Update troubleshooting articles.

5. Verify network connectivity to Defender update endpoints

• Ensure required URLs for Defender security intelligence updates are reachable through firewall/proxy as described in the network configuration guidance. Blocked endpoints will cause repeated failures.

6. Check event logs for detailed error codes

• In Event Viewer, review Microsoft-Windows-Windows Defender/Operational for Event ID 2001 (MALWAREPROTECTION_SIGNATURE_UPDATE_FAILED).
• Note the Update Source, Source Path, Error Code, and Error Description to identify whether the failure is at Search, Download, or Install stage and which source (Microsoft Update, WSUS, file share, MMPC) is failing.
• After correcting the identified issue, trigger another update via Windows Security or MpCmdRun.exe -SignatureUpdate.

7. As a last resort, roll back definitions and retry If the problem started immediately after a specific definition version and persists:
8. Open elevated Command Prompt in the Defender platform folder.
9. Run:

      MpCmdRun.exe -RemoveDefinitions -All
   

   This rolls security intelligence back to the previous/inbox version.
10. Then run:

        MpCmdRun.exe -SignatureUpdate
    

    to download fresh definitions.

If all of the above fail and Event ID 2001 continues to appear with the same error, collect the WindowsUpdate.log and Defender event details and contact Microsoft Support.

---

References:

• Microsoft Defender Antivirus security intelligence and product updates and support
• Troubleshoot Microsoft Defender Antivirus Security intelligence not getting updated
• Microsoft Defender Antivirus in the Windows Security app
• Microsoft Defender Antivirus on Windows Server
• Review event logs and error codes to troubleshoot issues with Microsoft Defender Antivirus