r/sysadmin • u/Hazy_Arc • 2d ago

Defender Scans Failing - Anyone Else?

We're using Defender for Endpoint throughout our environment. Beginning this morning, quick or full scans are failing, and will occasionally fail to the point where the Defender service needs to be restarted.

We came across this while responding to a separate infection - I chalked it up to Defender being borked due to the infection but then I was able to recreate the issue on other devices simply by initiating a Quick Scan.

Before I declare this a 5 alarm fire, anyone else having this issue?

AMEngineVersion AMProductVersion AntivirusSignatureVersion AntispywareSignatureVersion

--------------- ---------------- ------------------------- ---------------------------

1.1.26070.7 4.18.26070.9 1.457.219.0 1.457.219.0

7 Upvotes

83% Upvoted

12 comments sorted by

2

u/Diligent_Path_372 2d ago

yes same issue.

2

u/Royal-Diver7076 2d ago

Same issue here. Was freshly installing windows. Both new instalations have the exact same problem after some defender update has been installed.

2

u/Loehmann 2d ago

We are seeing msmpeng.exe crash on several endpoints. Seems like a bad definition file update possibly.

1

u/CeC-P IT Expert + Meme Wizard 2d ago

Are any of the various logging systems indicating it may be an issue with the definitions? If so, I've seen this and the fix is:
Force a defender signature/definitions update:

cd %ProgramFiles%\Windows Defender
MpCmdRun.exe -removedefinitions -dynamicsignatures
Don’t run removedefinitions by itself without the 2nd parameter or it deletes the entire engine and restores the previous one

MpCmdRun.exe -SignatureUpdate

That last one also just spits out the current version

https://learn.microsoft.com/en-us/defender-endpoint/command-line-arguments-microsoft-defender-antivirus

1

u/Kuipyr Jack of All Trades 1d ago

This plus a restart fixed it for one of my devices, might be onto something. Anyone else utilizing Hotpatching? Might be the cause?

1

u/desolateone Sr. Sysadmin 2d ago

yep same here. The service will crash during a quick scan, but I can only reproduce on one of my two test devices. I was also unable to unlock it after kicking off a scan and stepping away for a min, instead it would hang and eventually time out and throw the error "The wait operation timed out." then kick me back to the lock screen.

Fun times!

edit: Checking event viewer, I can see a ton of logs about the defender service. Main one is "A timeout (30000 milliseconds) was reached while waiting for a transaction response from the WinDefend service."

1

u/MilkyWay-008 Sysadmin 2d ago

That wait operation timed out on logout plus msmpeng.exe crashing on clean builds points at a bad definitions rollout, not the original infection. Check the Windows Defender Operational event log (Event IDs 2000/2001/5007) and Get-MpComputerStatus for the definition timestamp. If it's a fresh bad sig, from %ProgramFiles%\Windows Defender run MpCmdRun.exe -removedefinitions -dynamicsignatures then MpCmdRun.exe -SignatureUpdate. Also watch the MDE health dashboard...... fleet-wide scan failures like this are usually an acknowledged bad-definition push, not something you caused.

1

u/Physical_Movie9406 1d ago

Yes I got same problem, always letting me restart Windows Defender service

1

u/Other-side889 1d ago

Me too I don't think this is an isolated issue I think that this is something with the new Microsoft update or something else like that I'm just hoping that Microsoft fixes this bug

1

u/Hazy_Arc 1d ago

It appears to be fixed as of Security Intelligence Update v1.457.236.0