Windows defender definitions not updating on some clients through SCCM

Sarfraz Aslam 166 Reputation points
2022-03-02T12:30:34.037+00:00

Hi,
I am having issues that some clients showing having definitions older than 7 days. This is very frustrating. Kindly help me out to reduce count of "7 days old machines". Please let me know which logs needs to be check at client side.
I have configure the ADR rule and in Default Antimalware Client Policy, first source is Updates distributed from configuration manager.

179190-image.png

Microsoft Configuration Manager Updates
Microsoft Configuration Manager Updates
Microsoft Configuration Manager: An integrated solution for for managing large groups of personal computers and servers.Updates: Broadly released fixes addressing specific issue(s) or related bug(s). Updates may also include new or modified features (i.e. changing default behavior).
976 questions
Microsoft Configuration Manager
0 comments No comments
{count} votes

3 answers

Sort by: Most helpful
  1. Garth Jones 1,656 Reputation points MVP
    2022-03-02T14:32:01.497+00:00

    Have you reviewed the client to see what the logs say?

    0 comments No comments

  2. Kalyan Sundar 561 Reputation points
    2022-03-02T18:43:46.347+00:00

    To troubleshoot missing latest definitions you have to look into few log files,

    C:\programFiles\Microsoft Security Client\Antimalware or C:\programFiles\Windows Defender
    MPCacheState.log
    Mpdetection.log
    Mplog.log
    C:\Windows\CCM\Logs\EndpointProtectionAgent.log


  3. AllenLiu-MSFT 41,136 Reputation points Microsoft Vendor
    2022-03-21T07:47:18.25+00:00

    Hi, @Sarfraz Aslam

    Thank you for posting in Microsoft Q&A forum.

    May we know what's the definition status now? Have we fixed the issue?
    I think the computers have the definitions older than 7 days should have something wrong with software updates, we may first check WuaHander.log on the computers to see if the clients can scan the updates correctly?


    If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments No comments