Server 2025 KB5007651 Keeps Wanting to Re-Install over and over

Question

Server 2025 KB5007651 Keeps Wanting to Re-Install over and over

dcgtechnologies 10

I have Server 2025 and my server is completely up to date, but KB5007651 (Version 10.029554.1001) keeps constantly downloading and re-installing over and over again. I have tried everything I have googled on the internet from Stopping the Windows Update Service and Deleting the Software Distribution and Catoot2 folders starting services back up, hide the update, and disable the Windows Defender Firewall option, These fixes all seem to be for Windows 10 and 11 and not for Server 2025, but since this is a sysprep image, I want to make sure it is resolved before I use this image to deploy 2025 servers in my environment. The build I am running is 26100.32522 with Feature Experience Pack 1000.26100.275.0. Let's keep in mind this is not an activated copy since I want to use all my live keys on active servers and not a machine image.

How can I fix this permanently in the registry or file? I have tried installing it from the MS catalog from April 8, 2026 and when I do the installation manually of the patch the installation looksl ike it is going to start and then stalls out and no error or nothing in the event viewer. Any idea? Thank you.

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

2 answers

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer 1

Hello,

The behavior you are seeing with KB5007651 repeatedly downloading and reinstalling on Windows Server 2025 build 26100.32522 is not a generic Windows Update cache issue. That update is the Windows Defender Antivirus Platform Update, and it is known to loop when the servicing stack believes the patch is not fully applied. This typically happens in sysprep images or non‑activated builds because the update detection logic relies on registry and servicing stack state that is finalized only after activation.

Deleting SoftwareDistribution and Catroot2 folders is useful for clearing stale update metadata, but in your case the loop persists because the registry keys under HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates and the servicing stack catalog entries are not being updated correctly. On non‑activated images, the update installer may stall silently without logging an error, which matches what you described.

There is no supported permanent registry hack to suppress KB5007651. Microsoft’s servicing stack will continue to re‑offer it until the system reports the correct platform version. The only reliable way to break the loop is:

Ensure the image is fully activated before capture. Non‑activated builds often fail to commit Defender platform updates.
Apply the latest Servicing Stack Update (SSU) and Cumulative Update for Server 2025 before sysprep. These updates refresh the detection logic for Defender platform patches.
If you must work with a non‑activated image, disable Defender platform updates temporarily using Group Policy (Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > Signature Updates) and re‑enable after deployment and activation.

Since you mentioned this is a sysprep image, the best practice is to activate the reference machine, apply all cumulative and platform updates until Windows Update reports “no updates available,” then generalize with sysprep. Capturing a non‑activated image will almost always cause servicing anomalies like the one you are seeing.

In short, you cannot permanently fix KB5007651 in the registry or file system on a non‑activated Server 2025 image. The supported resolution is to activate the reference build, apply the SSU and cumulative updates, and then capture. If activation is not possible, you will need to accept that the Defender platform update will re‑apply after deployment until the machine is licensed.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

Domic Vo.

dcgtechnologies 10 Reputation points

2026-04-14T00:27:58.2466667+00:00

@Domic Vo Thank you for the wonderful explanation.

I have some clarifying questions to ask.

You had mentioned to apply the latest service stack update before the sysprep which I did based on the version I am on is 26100.32522. Is this the latest service stack update? I also read no matter if Windows is activated or not that all patches should apply. Is this correct?

You mentioned stop the Windows Defender Platform, which I thought I did by disabling the Windows Firewall service. Is this correct or is there more to disable? I already have a domain group policy created for Microsoft Defender Antivirus. I am not able to find that policy "(Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > Signature Updates)" under the local group policy using the Group Policy Management snapin. Where is it in local group policy if it is not in that location? Can you help me locate it? As for windows services all I see is Windows Defender Firewall service and do not see the Windows Defender Antivirus service. But I see it installed under Roles and Features on Server 2025. I did remove Windows Defender Antivirus from Roles and Features to see if I can stop the updates, but it still happens like you mentioned. Why was there Windows Antivirus service associated with it?

If I activate it, can I use the license again on an active server? This server is just an image at that point and that is why I do not activate sysprep images.

Thank you.

Answer 2

KB5007651 is the Windows Defender (Microsoft Defender Antivirus) platform update. The behavior described (repeated re‑offer, install stalling, no clear error) is consistent with a servicing issue in the Windows Server 2025 update chain rather than something that can be reliably fixed by registry edits on a sysprep image.

From the available information, the supported way to stabilize Windows Server 2025 update behavior is to ensure the image is on a later cumulative update where known servicing issues are resolved, rather than trying to suppress or hack around a specific Defender platform package.

Specifically:

Install a newer cumulative update on the image
- Install a cumulative update released on or after November 11, 2025 (for example, KB5068861 or later). These builds include fixes that remove the need for Known Issue Rollback (KIR) workarounds and address earlier update issues.
- For even newer builds, install a 2026 cumulative update such as KB5075899 (OS Build 26100.32370) on the image. Microsoft now ships the latest Servicing Stack Update (SSU) together with the Latest Cumulative Update (LCU), so applying the latest LCU also refreshes the servicing stack.
- Use Windows Update / Windows Update for Business on the reference VM and let it reach the latest available build (for example, 26100.32370 or later) before running sysprep.
Let Windows Update handle Defender platform updates
- Do not attempt to permanently block or remove KB5007651 in the registry or file system on the image. Defender platform updates are serviced as part of the OS security stack and are expected to re‑offer until the platform is at the required baseline for the installed OS build.
- Once the OS is on a current cumulative update with the integrated SSU, repeated re‑offers of older Defender platform packages typically stop because the newer LCU supersedes or correctly registers the Defender platform state.
If the image is on a pre‑November‑2025 build
- If using a build earlier than the November 11, 2025 cumulative update, and there are known issues affecting update applicability, apply the special Known Issue Rollback (KIR) Group Policy for Windows Server 2025, then reboot, and re‑run Windows Update before capturing the image. This ensures the update stack is in a supported state.
Capture the image only after updates are stable
- After installing a current cumulative update and letting Windows Update complete (no pending restarts, no repeated offers of the same Defender platform update), run sysprep and capture the image.
- Avoid capturing while a specific update (like KB5007651) is in a partially installed or repeatedly failing state, as that behavior can be baked into all deployed servers.

There is no supported registry or file‑level “permanent” block for KB5007651 on Server 2025 that would be preferable to moving the image to a newer, fixed cumulative update and letting the Defender platform be serviced normally.

References: