sccm windows defender definition updates

Extended management options for configuring security intelligence updates with Intune, Group Policy, and PowerShell.Improved output for Get-MpComputerStatus if scan results fail to retrieve.Security intelligence update version: 1.395.30.0.Fixed an issue in the attack surface reduction rule, Block Win32 API calls from Office macros, configured in warn mode where excluded files were incorrectly blocked until the next device reboot.Fixed an issue where device control policies weren't applied correctly without a reboot following product updates.DisableFtpParsing can now be configured through Set-MpPreference.Improved tamper protection on Windows Server 2016.Excluded IP addresses can now be configured using Intune.Fixed an issue where exclusions weren't applied correctly using gpupdate when registry policy processing was set to process even if Group Policy Objects didn't change.Fixed an issue where Microsoft Defender Antivirus switched from passive mode to active mode following an update on Windows Server 2016 and Windows Server 2012 R2 onboarded using the modern, unified client.Security intelligence update version: 1.397.59.0.Improved deployments safeguards for security intelligence updatesĪugust-2023 (Platform: 0.2006 | Engine: 0.2005).Improved reliability in scanning PE files.Improved parsing of attack surface reduction exclusions in the antimalware engine.Fixed issue in device control when querying Microsoft Entra group membership, which resulted in increased network traffic.

Improved installer of unified agent to include legacy version of Windows Server 2012 (.17735).

Added support for domain computer SID for device control policies.

Improved the performance of scanning files on network locations.

Fixed automatic remediation during on demand scans involving archives with multiple threats.

Support phase: Security and Critical Updates.Release date: Octo(Engine) | Octo(Platform).Security intelligence update version: 1.399.44.0.Integration improvements (Cloud, Microsoft 365 Defender).For more information, see Microsoft Defender for Endpoint update for EDR Sensor and What's new in Microsoft Defender for Endpoint on Windows. KB5005292 includes updates and fixes to the Microsoft Defender for Endpoint endpoint detection and response (EDR) sensor. In the Microsoft Endpoint Configuration Manager / Windows Server Update Services (MECM/WSUS) catalog, the category Microsoft Defender for Endpoint includes updates for the MSSense service in KB5005292. Platform updates are retried after a reboot or when all monitored services are stopped. Platform updates can be temporarily postponed if other protection features (such as Endpoint DLP or Device Control) are actively monitoring running processes. The mde-urls workbook also lists the services and their associated URLs that your network must be able to connect to, as described in Enable access to Microsoft Defender for Endpoint service URLs in the proxy server. If you're looking for a list of Microsoft Defender processes, download the mde-urls workbook, and then select the Microsoft Defender Processes worksheet. To learn more about security intelligence updates, see Security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware. To learn more about the gradual rollout process, and to see more information about the next release, see Manage the gradual rollout process for Microsoft Defender updates. See the latest broad channel release here. This article lists changes that are included in the broad release channel. Monthly updates are released in phases, resulting in multiple packages visible in your Window Server Update Services. The usual methods you use to deploy Microsoft and Windows updates to endpoints in your network.įor more information, see Manage the sources for Microsoft Defender Antivirus protection updates.You can manage the distribution of updates through one of the following methods: Microsoft Defender Antivirus requires monthly updates (KB4052623) known as platform updates. For more information, see Use Microsoft cloud-provided protection in Microsoft Defender Antivirus.įor a list of recent security intelligence updates, see Security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware.Įngine updates are included with security intelligence updates and are released on a monthly cadence. Security intelligence updates occur on a scheduled cadence (configurable via policy). System Center Endpoint Protection: KB2461484Ĭloud-delivered protection is always on and requires an active connection to the Internet to function.Microsoft Defender Antivirus: KB2267602.Updates are released under the following KBs:

Sccm windows defender definition updates