Security Intelligence isn't updating

Try this troubleshooting path for Microsoft Defender Antivirus security intelligence updates that are stuck on searching:

1. Confirm Microsoft Defender Antivirus is the primary antivirus. If a non-Microsoft antivirus is registered through Windows Security Center, Microsoft Defender Antivirus can be disabled and security intelligence updates will not occur.
2. Check network access for Defender update endpoints. Make sure the required URLs for security intelligence updates are allowed through the firewall or proxy.
3. Check for SSL inspection on those URLs. If the update traffic is SSL inspected, Defender can fail to resolve or reach update services. One documented symptom is Event ID 2001 with error 0x80072ee7.
4. Verify required services are running:
   • Windows Update
   • Background Intelligent Transfer Service (BITS)
5. If a fallback order policy is configured, make sure MicrosoftUpdateServer is first in the list.
6. Test a manual definition update. Download and install the latest security intelligence package manually from the Microsoft Defender updates site. If the manual update works, the issue is likely with the configured update source rather than the Defender engine itself.
7. If manual update works, try updating through MMPC using an elevated Command Prompt. The documented troubleshooting flow recommends using MpCmdRun from an elevated Command Prompt after changing to the Defender platform folder.
8. If MpCmdRun works, check these common causes:
   • The fallback order points to a WSUS server that does not have Security intelligence updates approved.
   • A configured UNC share for updates is stale.
   • The Windows Update service has its own update issues.
9. Collect diagnostics if the issue continues. Use the Microsoft Defender for Endpoint Client Analyzer tool, or Microsoft Defender Antivirus diagnostic data collection. You can also convert WindowsUpdate.etl to readable output with Get-WindowsUpdateLog to investigate why the update scan is hanging.

Important: reviewing HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\WUServer is useful only if WSUS is in use. Registry review should be done carefully because incorrect changes can affect update behavior.

• Troubleshoot Microsoft Defender Antivirus Security intelligence not getting updated
• Troubleshooting Security Intelligence Updates from Microsoft Update source
• Microsoft Defender Antivirus security intelligence and product updates and support