Include windows defender definitions

When you are using Windows 10 and Windows Defender in Windows 10 then the definitions are as old as the .WIM file is. It is a good idea to update the definitions during OSD to make sure that the latest definitions are there.

I have used Chris Nackers post and script a lot for downloading and deploying the definitions for System Center Endpoint Protection during OS deployment in Windows 7, Windows 8. http://www.chrisnackers.com/2012/10/18/configuration-manager-2012-installing-endpoint-protection-during-a-task-sequence/

This post will cover how we can do the same for Windows Defender when deploying Windows 10, it is actually much easier as we don’t have to install the Windows Defender client as it is already included in Windows 10. My colleague Johan Schrewelius and I put together this little script that can be run as a Schedule Task that download the definitions from Microsoft to the UNC path and update the package source files in a specific DP group.

The script can be downloaded here: https://onevinn.schrewelius.it/Scripts01.html

Here is how to use it:

1. To start with we create the following structure, “Defender Definition“, with two underlying leaflets for each architecture, on our Package-share to which we can download the definition files:

Windows_Def1

2. Download the script from the link above and place the script in any folder, for example. “C:\Scripts”

Windows_Def2

3. Then we create the Package that will be used in Configuration Manager as wee need the PackageID in the powershell script to be able to update it when a new version is downloaded. Use the folder we created above as the package source, in this example:”\\CM2012R2\pkgshare$\Defender definitions”

WindowsDef_9

4. Then we select a Standard Program as well, we need three more if both Windows 10 i386 and X64 is used as wee need two for each architecture

WindowsDef_10

5.  Use the following command  for the first x86 program “mpam-fe.exe” with the command line x86\mpam-fe.exe as shown below, we cannot browse as we haven’t downloaded the files just yet. There are two files per architecture that needs to be installed.

WindowsDef_11

6. Limit so that the application can only be run on 32-bit Windows 10.

WindowsDef_112

7. Create three more programs one more for x86, the command line for the second x86 Program should be x86\nis_full.exe. Then it should look like this.

WindowsDef_16

8. Then we create two more programs for X64 with the same commands but run from the x64 folder instead. So it looks like this in the console.

WindowsDef_161

9. Then we distribute the content to a Distribution Point Group

10. Now we can have a PackageID as well for the package which can be found in the Configuration Manager Admin Console, in this example 06000159

Windows_Def162

11. Now we edit the script that we placed in the C:\Scripts folder and change the following lines to reflect our environment.

Windows_Def172

12. Now we create a Schedule Task that will download the definition updates and update the package on the DP’s in the Distribution Point Group.

WindowsDef_4

13. Schedule it to run it daily at 5 AM

WindowsDef_5

14. Use the task “Start a program

Program: Powershell.exe

Arguments: -NoProfile-ExecutionPolicy ByPass-File C:\scripts\DownloadDefenderDefinitions.ps1

WindowsDef_6

15. Then we can test the Schedule Task to make sure everything works by right-click the new event “Download Defender Definition” and select Run:

16. Examine the contents of both x 86 and x 64 leaflet under ‘Defender Definition“, they should now contain two files each with name as shown.

WindowsDef_8

17. In the Configuration Manager Admin Console check the content status for the Package so that it was updated successful.

Windows_Def173

18. Then we add the steps to the Task Sequence to install the updated definitions
Add a new group “Defender Definition Updates” in the TS and restrict this to Windows 10 (32-and 64-bit).

WindowsDef_17

19. Then we add the four programs that should be run, restrict them to run only on the correct architecture.

WindowsDef_19

Then we are ready to deploy Windows 10 including the latest Windows Defender updates.

In today’s digital landscape, cybersecurity has never been more crucial. Malware, viruses, and cyber threats loom over our personal data, financial information, and online privacy. Windows Defender, now known as Microsoft Defender Antivirus, is a built-in antivirus solution that comes with Windows operating systems, providing users with essential protection against these threats. This tutorial walks you through the process of updating definitions and scanning for viruses using Windows Defender, ensuring that your system remains fortified against emerging threats.

Understanding Windows Defender

Windows Defender is an integrated security feature available on Windows systems that provides real-time protection against malware, harmful software, and other potential threats. Built into Windows 8, 8.1, and 10, it has evolved significantly into a comprehensive security suite over the years. Features of Windows Defender include:

  1. Real-Time Protection: Active monitoring of your system in real-time.
  2. Cloud-Based Protection: The ability to leverage the power of the cloud to enhance threat detection.
  3. Automatic Updates: Keeping virus definitions and security features up to date.
  4. Scheduled Scans: The option to plan when the scans occur, according to your convenience.
  5. Full, Quick, and Custom Scans: Flexibility to conduct different types of scans based on your needs.

While Windows Defender provides a robust level of protection, users must know how to effectively utilize its features, especially in updating virus definitions and performing system scans.

Getting Started with Windows Defender

Before diving into the specifics of updating definitions and scanning for viruses, let’s ensure you know how to access Windows Defender.

  1. Accessing Windows Defender:

    • Click on the Start menu.
    • Type “Windows Security” in the search bar and press Enter.
    • This will open the Windows Security app, which houses all the security features, including antivirus and threat protection settings.
  2. Navigating Windows Security:

    • The interface consists of several sections including Home, Virus & threat protection, Account protection, Firewall & network protection, and others.
    • Make sure you are under the Virus & threat protection section where most actions related to malware protection are handled.

Updating Definitions in Windows Defender

Virus definitions are crucial because they allow the security software to identify and combat the latest threats. Regularly updating these definitions ensures that your Windows Defender remains effective against newly discovered malware and threats.

How to Update Virus Definitions

  1. Automatic Updates:

    • Windows Defender typically updates virus definitions automatically if your system is connected to the internet. To ensure this feature is enabled:
      • Go to Settings (click on the Start menu and select the gear icon).
      • Navigate to Update & Security > Windows Update.
      • Click on Advanced options and ensure that the option to receive updates for other Microsoft products when you update Windows is turned on.
  2. Manual Updates:

    • If you want to manually check for updates, follow these steps:
      • Open Windows Security (as detailed above).
      • Click on Virus & threat protection.
      • Under the Virus & threat protection updates section, you will see options for updating. Click on Check for updates.
      • Windows Defender will then connect to Microsoft’s servers and download any necessary updates.
  3. Checking Definition Version:

    • To verify that your definitions are up to date, you can view the Virus & threat protection updates section. Here, you will find the Virus definition version displayed. Ensure that it is recent to guarantee optimal protection.

Importance of Regular Updates

Maintaining up-to-date virus definitions is essential for a few reasons:

  • Protection Against New Threats: Cyber threats evolve rapidly. Regular updates equip Windows Defender with the latest knowledge to recognize and neutralize new strains of malware.

  • Vulnerability Management: Outdated definitions may cause the software to overlook or misidentify potential threats, leaving your system vulnerable.

  • Improved Performance: New updates may also improve the performance of the antivirus software, making it more efficient in scanning and protecting your system.

Scanning for Viruses

After ensuring your definitions are current, the next step is to conduct a scan for viruses. Windows Defender offers multiple scanning options based on the level of intensity needed.

Types of Scans Available

  1. Quick Scan: This option scans the most common areas where malware tends to hide, including system files that are often the targets of malware attacks. It’s a fast process but may not be as thorough.

  2. Full Scan: A comprehensive scan of the entire system, including all files and running programs. This scan can take a considerable amount of time, especially on systems with a lot of data, but is the best choice when you suspect a potential infection.

  3. Custom Scan: Allows you to select specific files and folders to scan. This option is useful when you want to check a particular area of your system or if you’ve recently downloaded files from an untrusted source.

  4. Microsoft Defender Offline Scan: This powerful scan operates outside of the Windows environment, making it useful for detecting and removing stubborn malware. It requires a restart of your PC and runs a scan before Windows loads.

How to Perform a Scan

  1. Initiating a Quick or Full Scan:

    • Open Windows Security.
    • Click on Virus & threat protection.
    • Under the Current threats section, click on Scan options. Here you can choose between Quick scan, Full scan, or Custom scan.
    • Select Quick scan or Full scan and click on Scan now. The scanning process will begin, and you’ll be provided with a progress indicator.
  2. Conducting a Custom Scan:

    • Open Windows Security.
    • Navigate to Virus & threat protection.
    • Click on Scan options.
    • Select Custom scan and then click Scan now.
    • When prompted, choose the specific folders or files you wish to scan. Click on Select Folder to begin the scan.
  3. Using Microsoft Defender Offline Scan:

    • Open Windows Security.
    • Click on Virus & threat protection.
    • Navigate to Scan options and select Microsoft Defender Offline scan.
    • Click on Scan now. Your system will reboot, and the scan will take place outside the Windows environment.

Understanding Scan Results

Once the scan is complete, Windows Defender will present you with the results:

  • If threats are detected, Windows Defender will provide options to quarantine, remove, or allow the detected threats.

    • Quarantine: Places the infected files in a safe haven, preventing them from causing harm, while allowing you to assess what to do next.
    • Remove: Deletes the malware from your system permanently.
    • Allow: This option is generally not recommended unless you are confident that the detection is a false positive.
  • You can also view detailed protection history by navigating to Virus & threat protection > Protection history. Here, you can see previous threats detected, action taken, and additional details about each incident.

Best Practices When Using Windows Defender

  1. Regularly Update Definitions: Always ensure that Windows Defender is set to automatically update virus definitions. Manual checks should also be performed periodically.

  2. Frequent Scans: Set a schedule for regular scans, particularly for Full scans, which can uncover hidden threats.

  3. Be Cautious Online: Antivirus software doubles its effectiveness when users practice safe browsing habits. Avoid clicking on unknown links and downloading software from untrusted sources.

  4. Utilize Additional Features: Windows Defender includes additional settings such as controlled folder access to protect specific folders from unauthorized changes by malware.

  5. Stay Informed: Keep up with the latest cybersecurity news. Understanding current threats can help you take proactive measures to protect your system.

  6. Consider Third-Party Solutions if Necessary: While Windows Defender is generally effective, depending on your needs, you may wish to consider third-party antivirus solutions that offer advanced features or additional layers of protection.

Conclusion

Utilizing Windows Defender effectively—by regularly updating definitions and performing thorough scans—plays a pivotal role in safeguarding your system from malware and other security threats. By making this a part of your routine digital hygiene, you can enhance your overall online security posture. Remember, security isn’t solely the responsibility of your antivirus solution; it involves being vigilant and consistently practicing safe computing habits.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Sign up

Windows Defender Antivirus#

Windows Defender, also known as Windows Security, is Microsoft’s built-in antivirus and anti-malware software included with Windows operating systems. It plays a crucial role in protecting your computer from various security threats, including viruses, malware, and spyware. To ensure that your computer is adequately protected, it’s essential to configure Windows Defender correctly. This guide will walk you through the essential steps and settings for configuring Windows Defender effectively.

Why Configure Windows Defender?#

Configuring Windows Defender is essential because it allows you to customize the security settings to suit your specific needs. By default, Windows Defender provides a reasonable level of protection for most users. However, adjusting its settings can enhance your computer’s security and improve your overall experience. Additionally, configuring Windows Defender ensures that it runs efficiently and doesn’t disrupt your workflow with unnecessary notifications.

Windows Defender

Accessing Windows Defender#

Before diving into the configuration options, let’s discuss how to access Windows Defender on your Windows computer:

  1. Open Windows Security:

    • Press Windows + S on your keyboard to open the Windows search bar.

    • Type “Windows Security” and press Enter.

    • Alternatively, you can access it from the system tray by clicking the shield-shaped icon.

Now that you have accessed Windows Defender, let’s explore the various settings you can configure.

Configuring Windows Defender Settings#

1. Virus & Threat Protection Settings#

The Virus & Threat Protection settings are the core of Windows Defender’s configuration. To access these settings, follow these steps:

  1. Open Windows Security as mentioned earlier.

  2. Click on “Virus & Threat Protection” in the left sidebar.

a. Real-time Protection#

Real-time protection is the feature that scans files and programs as they are accessed or opened. It’s crucial to keep this feature enabled to ensure that Windows Defender can detect and block threats in real-time. By default, it should be turned on. To verify its status:

  1. Under “Virus & Threat Protection settings,” locate “Real-time protection.”

  2. Ensure that the toggle switch is set to “On.”

b. Cloud-delivered Protection#

Cloud-delivered protection enhances the accuracy and speed of threat detection by using Microsoft’s cloud infrastructure. This feature should also be enabled by default. To confirm its status:

  1. Under “Virus & Threat Protection settings,” find “Cloud-delivered protection.”

  2. Ensure that the toggle switch is set to “On.”

c. Automatic Sample Submission#

Automatic sample submission allows Windows Defender to collect and send suspicious files to Microsoft for analysis. This helps improve the overall security of Windows Defender. To check its status:

  1. Under “Virus & Threat Protection settings,” look for “Automatic sample submission.”

  2. Ensure that the toggle switch is set to your preferred option, typically “On.”

2. App & Browser Control Settings#

The App & Browser Control settings in Windows Defender focus on protecting your computer while using applications and browsing the internet. To access these settings:

  1. Open Windows Security.

  2. Click on “App & Browser Control” in the left sidebar.

a. Reputation-based Protection#

Reputation-based protection helps Windows Defender identify potentially harmful files and apps. It uses reputation data to determine whether a file or app is trustworthy or not. This feature is usually set to “Warn” by default. To configure it:

  1. Under “Reputation-based protection settings,” click on “Reputation-based protection settings.”

  2. Choose your preferred option: “Block,” “Warn,” or “Off.”

b. SmartScreen for Microsoft Edge#

SmartScreen for Microsoft Edge is a security feature that helps protect you from malicious websites and downloads while using the Microsoft Edge browser. To configure this feature:

  1. Under “SmartScreen settings for Microsoft Edge,” click on “SmartScreen for Microsoft Edge settings.”

  2. Choose your preferred option: “Block,” “Warn,” or “Off.”

3. Firewall & Network Protection Settings#

Windows Defender also includes a built-in firewall to protect your computer from unauthorized network access. To configure Firewall & Network Protection settings:

  1. Open Windows Security.

  2. Click on “Firewall & Network Protection” in the left sidebar.

Network Profile#

Windows allows you to set different firewall rules for different network profiles: Public, Private, and Domain. To configure network profiles:

  1. Under “Firewall & Network Protection settings,” click on “Change notification settings” next to your current network profile (e.g., Public network).

  2. Choose your preferred notification settings for each network profile.

b. Allow an App Through Firewall#

If you want to allow a specific app through the firewall, you can configure this under “Allow an app through firewall.” Here’s how:

  1. Under “Firewall & Network Protection settings,” click on “Allow an app through firewall.”

  2. Click “Change settings.”

  3. Select the app you want to allow or block.

  4. Check or uncheck the boxes under “Private” and “Public” depending on your preference.

4. Device Security Settings#

The Device Security settings in Windows Defender provide information about the security status of your device. To access these settings:

  1. Open Windows Security.

  2. Click on “Device Security” in the left sidebar.

Core Isolation and Memory Integrity#

Core Isolation and Memory Integrity are advanced security features that protect your computer from sophisticated attacks. To check their status:

  1. Under “Device Security,” click on “Core Isolation and Memory Integrity.”

  2. Ensure that both features are turned on if supported by your hardware.

5. Account Protection Settings#

Windows Defender also offers account protection settings, which are particularly relevant if you use a Microsoft account to log in to your computer. To access these settings:

  1. Open Windows Security.

  2. Click on “Account Protection” in the left sidebar.

Windows Hello Face/Fingerprint Recognition#

If your computer supports Windows Hello face or fingerprint recognition, you can configure it for added security. To set up Windows Hello:

  1. Under “Account Protection,” click on “Set up” under “Windows Hello Face” or “Windows Hello Fingerprint,” depending on your device’s capabilities.

  2. Follow the on-screen instructions to set up Windows Hello.

6. Device Performance & Health Settings#

Device Performance & Health settings in Windows Defender provide insights into the overall health of your computer, including security updates and storage space. To access these settings:

  1. Open Windows Security.

  2. Click on “Device Performance & Health” in the left sidebar.

Fresh Start#

Fresh Start is a feature that allows you to reinstall Windows while keeping your personal files and some settings intact. This can be useful if your computer is experiencing serious issues. To initiate a Fresh Start:

  1. Under “Device Performance & Health,” click on “Additional info.”

  2. Click on “Get started” under “Fresh Start.”

Customizing Windows Defender Notifications#

Windows Defender may occasionally display notifications about detected threats or security issues. These notifications can be useful, but they can also be disruptive if you receive too many of them. To customize Windows Defender notifications:

  1. Open Windows Security.

  2. Click on “Settings” at the bottom of the left sidebar.

  3. Under “Notifications,” you can toggle various notification types on or off based on your preference.

Manual Scans and Updates#

In addition to configuring the settings mentioned above, it’s a good practice to perform manual scans

and ensure that your antivirus definitions are up to date.

Performing a Manual Scan#

  1. Open Windows Security.

  2. Click on “Virus & Threat Protection.”

  3. Under “Quick Scan,” click “Quick Scan” for a fast check or “Full Scan” for a comprehensive scan of your computer.

Updating Antivirus Definitions#

Keeping your antivirus definitions up to date is crucial for effective protection. To update Windows Defender antivirus definitions manually:

  1. Open Windows Security.

  2. Click on “Virus & Threat Protection.”

  3. Under “Virus & Threat Protection updates,” click “Check for updates.”

Final Words#

Configuring Windows Defender is a critical step in ensuring the security of your Windows computer. By customizing the settings to your preferences and regularly performing manual scans and updates, you can significantly enhance your computer’s protection against viruses, malware, and other security threats. Remember that while these settings provide a high level of security, it’s essential to practice safe computing habits, such as being cautious when downloading files or clicking on links, to maintain a secure computing environment.

How to Manually Update Security Intelligence Definitions for Windows Defender Antivirus in Windows 10

Windows Defender Antivirus uses security intelligence definitions to detect threats. Windows 10 automatically downloads the most recent intelligence available through Windows Update.  You can download them and update definitions manually when needed, e.g. to secure an offline device.

Windows Defender is the default antivirus app shipped with Windows 10. Earlier versions of Windows like Windows 8.1, Windows 8, Windows 7 and Vista also had it but it was less efficient previously as it only scanned spyware and adware. In Windows 8 and Windows 10, Defender is based on the Microsoft Security Essentials app which offers better protection by adding full blown protection against all kinds of malware. Microsoft is renaming the app Microsoft Defender.

Recent Windows 10 version come with is a new app called Windows Security. The application, formerly known as «Windows Defender Dashboard» and «Windows Defender Security Center», has been created to help the user control his security and privacy settings in a clear and useful way. It includes all the settings related to Windows Defender. The Security Center app is reviewed in the post Windows Defender Security Center in Windows 10 Creators Update.

Note: Windows 10 allows to only temporary disable Windows Defender with a special option in Windows Security. After some period of time, it will be re-enabled automatically. If you need to disable it permanently, see Disable Windows Defender in Windows 10.

Microsoft continually updates security intelligence in antimalware products to cover the latest threats and to constantly tweak detection logic, enhancing the ability of Windows Defender Antivirus and other Microsoft antimalware solutions to accurately identify threats. This security intelligence works directly with cloud-based protection to deliver fast and powerful AI-enhanced, next-generation protection.

Here’s how to update definitions manually if you are connected to the Internet

Trigger a definition update for Windows Defender Antivirus

  1. Open the Settings app.
    Windows 10 Creators Update Settings 15019

  2. Go to Update & security -> Windows Update.
    Windows 10 Windows Update Creators Update Settings

  3. On the right, click Check for updates.
    Windows 10 Download And Install Update Notification

  4. Windows 10 will download and install definitions for Defender (if available).
    Windows 10 Build 17127 Update

Alternatively, you can trigger the update from the command prompt. This is possible with  the console MpCmdRun.exe utility which is part of Windows Defender and used mostly for scheduled scanning tasks by IT administrators. The MpCmdRun.exe tool has a number of command line switches which can be viewed by running MpCmdRun.exe with «/?».

Trigger a definition update for Windows Defender Antivirus using command prompt

  1. Open an elevated command prompt.
  2. Type or copy-paste the following command to update definitions:
    "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -SignatureUpdate
  3. You are done.

Note: You may want to clear the definition cache before updating them. To do this, run the commands:

  • Clear the cache: "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -removedefinitions -dynamicsignatures.
  • Update definitions: "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -SignatureUpdate.

Finally, if you need to update a device that is not connected to the Internet, or need a local copy of security definitions for Windows Defender Antivirus, do the following.

  1. Point your browser to the following page: Security Definitions Download
  2. Scroll down to the Manually download the update section.
    Windows 10 Update Defender Definitions

  3. Select 32-bit or 64-bit update package matching your operating system. See how to determine if you are running 32-bit Windows or 64-bit.
  4. Download and run the mpam-fe.exe file.

You are done!

As of this writing, the following download links were available for Windows 10 and Windows 8:

  • 32-bit
  • 64-bit
  • ARM

That’s it.

Support us

Winaero greatly relies on your support. You can help the site keep bringing you interesting and useful content and software by using these options:

If you like this article, please share it using the buttons below. It won’t take a lot from you, but it will help us grow. Thanks for your support!

Понравилась статья? Поделить с друзьями:
0 0 голоса
Рейтинг статьи
Подписаться
Уведомить о
guest

0 комментариев
Старые
Новые Популярные
Межтекстовые Отзывы
Посмотреть все комментарии
  • Установить в windows шрифты штрих кодов
  • Не удается создать новую схему электропитания windows 10
  • Не могу установить принтер hp laserjet p1102 на windows 10
  • Windows xp не видит скрытую сеть
  • Macbook pro trackpad driver for windows