Good question! The documentation around these Defender updates is sorely lacking. I also saw our Patch team published a couple of new fixlets in âPatches for Windowsâ -
405262302 4052623: Update for Microsoft Defender antimalware platform - Microsoft Defender Antivirus - KB4052623
405262303 4052623: Update for Microsoft Defender antimalware platform - Microsoft Defender Antivirus - KB4052623 (x64)
âŠin addition to the one we were just discussing from âUpdates for Windows Applications Extendedâ -
5603601 Update: Windows Defender Virus Definitions v1.393.1315.0 - Windows (x64)
TL;DR - I suggest running both fixlets, the fixlet in âPatches for Windowsâ updates the Defender service binaries but not definitions or threat intelligence; the update in 'Updates for Windows Applications Extended" updates the definitions and thread intelligence DLL but not the Defender service binary.
These fixlets use different downloads, and it wasnât clear where the overlaps are.
I set up a test, Win10 1909 un-patched instance to try them out.
I used a simple command line to find every instance of mpengine.dll on the disk to compare them before-and-after
dir /s /b mpengine.dll > \temp\mpengine_versions.txt
Before running any updates
q: unique values of (it as string as version) of values whose(name of it = "ASSignatureVersion" OR name of it = "AVSignatureVersion") of keys "Signature Updates" of (keys "Microsoft Antimalware" of it ; keys "Windows Defender" of it) of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft" of native registry
A: 1.285.74.0
q: image paths of service whose (display name of it as lowercase contains "defender antivirus service" or display name of it as lowercase contains "windows defender service")
A: "C:\Program Files (x86)\Windows Defender\MsMpEng.exe"
q: version of file "C:\Program Files\Windows Defender\MsMpEng.exe"
A: 4.18.1902.5
q: (version of it, pathname of it) of native files (lines of file "c:\temp\mpengine_versions.txt")
A: 1.1.15600.4, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Default\MpEngine.dll
A: 1.1.15600.4, C:\Users\All Users\Microsoft\Windows Defender\Definition Updates\Default\MpEngine.dll
A: 1.1.15600.4, C:\Windows\WinSxS\amd64_windows-defender-am-engine_31bf3856ad364e35_10.0.18362.1_none_d188cb97337971c6\MpEngine.dll
(side note - I may have found a bug in the âimage path of serviceâ inspector, weâre looking into that. Where I retrieve the verision of MsMpEng.exe above, I manipulated the path manually. For this particular fixlet it wonât matter - the update actually moves the image path of the MsMpEng.exe to a new path and it will not hit the edge-case that may be an inspector bug.)
Running the update from âPatches for Windowsâ - relocates MsMpEng.exe from \Program Files to \ProgramData, restarts the service, and updates the MsMpEng.exe binary. It does not update or add any mpengine.dll files, nor the signature versions
q: unique values of (it as string as version) of values whose(name of it = "ASSignatureVersion" OR name of it = "AVSignatureVersion") of keys "Signature Updates" of (keys "Microsoft Antimalware" of it ; keys "Windows Defender" of it) of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft" of native registry
A: 1.285.74.0
q: image paths of service whose (display name of it as lowercase contains "defender antivirus service" or display name of it as lowercase contains "windows defender service")
A: "C:\ProgramData\Microsoft\Windows Defender\platform\4.18.23050.9-0\MsMpEng.exe"
q: version of file "C:\ProgramData\Microsoft\Windows Defender\platform\4.18.23050.9-0\MsMpEng.exe"
A: 4.18.23050.9
q: (version of it, pathname of it) of native files (lines of file "c:\temp\mpengine_versions.txt")
A: 1.1.15600.4, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Default\MpEngine.dll
A: 1.1.15600.4, C:\Users\All Users\Microsoft\Windows Defender\Definition Updates\Default\MpEngine.dll
A: 1.1.15600.4, C:\Windows\WinSxS\amd64_windows-defender-am-engine_31bf3856ad364e35_10.0.18362.1_none_d188cb97337971c6\MpEngine.dll
Running the signature updates from âUpdates for Windows Applications Extendedâ updates the signature versions, and adds new instances of mpengine.dll with the newer versions. It does not update the MsMpEng.exe version or relocate the service to ProgramData:
q: unique values of (it as string as version) of values whose(name of it = "ASSignatureVersion" OR name of it = "AVSignatureVersion") of keys "Signature Updates" of (keys "Microsoft Antimalware" of it ; keys "Windows Defender" of it) of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft" of native registry
A: 1.393.1315.0
q: (version of it, pathname of it) of native files (lines of file "c:\temp\mpengine_versions.txt")
A: 1.1.15600.4, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
A: 1.1.15600.4, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Default\MpEngine.dll
A: 1.1.23060.1005, C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{2CB60B59-2884-4088-9245-1F04FBA247E5}\mpengine.dll
A: 1.1.15600.4, C:\Users\All Users\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
A: 1.1.15600.4, C:\Users\All Users\Microsoft\Windows Defender\Definition Updates\Default\MpEngine.dll
A: 1.1.23060.1005, C:\Users\All Users\Microsoft\Windows Defender\Definition Updates\{2CB60B59-2884-4088-9245-1F04FBA247E5}\mpengine.dll
A: 1.1.15600.4, C:\Windows\WinSxS\amd64_windows-defender-am-engine_31bf3856ad364e35_10.0.18362.1_none_d188cb97337971c6\MpEngine.dll
After running the definitions update from âPatches for Windows Applications Extendedâ, new versions of the DLL are present and appear to be used, but the update does not appear to remove the old DLL and it is kept in different locations. Iâm not sure whether your endpoint scanner will trigger a positive or negative in this case, whether itâs smart enough to check for which .dll is actually being used, choosing the current DLL among the several copies present.
