Update for Windows Security platform - KB5007651 (Version 10.0.29628.1000)

Check Windows Security → Settings → About: if the Windows Security service/platform version is 10.0.29628.1000 or later, the month-old “Pending download” entry is most likely stale Windows Update applicability reporting rather than a missing security platform update.

Interpret the installed versions

KB5007651 updates the Windows Security app and its underlying service. Microsoft classifies it as a Definition Update in the Microsoft Security platform category, and the documented package applies to Windows 11 build 22000 or later.^1^

1. Open Windows Security.
2. Select Settings at the lower left.
3. Select About.
4. Record the following separately:
   • Windows Security application version
   • Windows Security service/platform version
   • Antimalware client version

Alternatively, open PowerShell and run:

Get-AppPackage Microsoft.SecHealthUI |
    Select-Object Name, Version, Status

Do not compare the antimalware client version with 10.0.29628.1000; they identify different components. In the matching case, Windows Update continued offering this exact KB even though the About page already showed platform version 10.0.29628.1000, indicating an update detection/applicability inconsistency.^2^

If version 10.0.29628.1000 or later is installed

The platform payload is already present. Version 10.0.29628.1000 has also been superseded by 10.0.29680.1000, so do not manually force the older package.^3^

1. Restart the device once.
2. Go to Settings → Windows Update → Check for updates.
3. Allow Windows Update or your organization’s update-management service to offer the newer revision.
4. If the old revision remains pending while the installed platform is equal to or newer than it, treat it as a reporting/compliance issue and inspect the update source and applicability results rather than repeatedly reinstalling it.

There is no published Microsoft known-issue notice establishing a universal defect for this exact pending state, so the pending label alone does not establish its cause.

If the installed platform is older

Treat it as a genuinely stalled update:

1. On Windows 11, open Settings → System → Troubleshoot → Other troubleshooters.
2. Find Windows Update and select Run.
3. Restart, then open Settings → Windows Update → Check for updates.^4^

If it remains pending, clear the Windows Update download cache:

1. Back up important files.
2. Press Win+R, enter services.msc, and press Enter.
3. Stop the Windows Update service.
4. Delete the contents—not the folder itself—of C:\Windows\SoftwareDistribution.
5. Return to Services and start Windows Update.
6. Check for updates again.

This removes cached update downloads and forces Windows Update to detect and download them again.^4^

For organization-managed devices

If the device is managed by Intune, WSUS, Group Policy, or another patching product, determine which service initiated the scan and which policies control update offering. A device is update-managed when policies or management tools determine which updates are offered or how installation behaves.^5^

If the installed platform is current but KB5007651 remains pending in both Windows Update and the management console, open a Microsoft Support case and include:

• Windows edition, version, and OS build
• Windows Security application and platform versions
• Complete Windows Update logs
• KB5007651 Update ID and revision
• Update-management product detection results
• Whether the behavior affects one or multiple devices

That evidence is required to investigate the device’s update applicability state; the pending status by itself cannot distinguish service metadata, client detection, or management-policy causes.

References

1. Windows Security app update | Microsoft Support
2. KB5007651 (version 10.0.29628.1000) still showing as outstanding in Windows Update after installation - Microsoft Q&A
3. Microsoft Update Catalog
4. [Windows 10](https://support.microsoft.com/windows/deployment/updates-lifecycle/troubleshoot-problems-updating-windows#general-troubleshooting)
5. Defining Windows update-managed devices