Forum Discussion

Niels van Dijk's avatar
Niels van Dijk
Copper Contributor
May 10, 2021

Defender Antivirus status "not updated"

Antivirus intelligence updates are updated multiple times a day. Our W10 endpoint update successfully, but still the Defender for Endpoint AV status shows "not updated" on a large amount of endpoints...
CoryIntMSFT's avatar
CoryIntMSFT
Former Employee
May 13, 2021

Niels van Dijk 

We spoke with our devs regarding your questions/issues.  They confirmed that it can take up to 24 hours for a newer signature to appear in the MDE portal.  The process looks like this:

 

  1. MsSense.exe collects version info via IWscProduct::get_SignatureStatus API method
  2. TVM will then collect this info anywhere from 12-24 hours and feed it to the DB servers (MDE Portal)

Our devs are looking at reducing this time, but doing so may introduce performance related issues.

 

If you need accurate/up-to-date Def/Sig information from your clients, you should not be using MDE for this.  You should use Intune or SCCM.

 

For Intune, please see this link:

Announcing new Endpoint Security Antivirus reports!

https://techcommunity.microsoft.com/t5/intune-customer-success/announcing-new-endpoint-security-antivirus-reports/ba-p/1666326

 

For SCCM, please see this link:

How to Monitor Endpoint Protection in Configuration Manager

https://docs.microsoft.com/en-us/previous-versions/system-center/system-center-2012-R2/hh508769(v=technet.10)

 

For the “Antivirus status” column, Updated means the last time TVM pulled the data had the most current Def/Sig that it was aware of.  Not Updated means the sig/def was old.