Where Does Defender Store Definition Updates?
Defender security intelligence lives in Definition Updates under ProgramData, installed as KB2267602.
Last updated
Defender's brains sit in C:\ProgramData\Microsoft\Windows Defender\Definition Updates, delivered as KB2267602 on a near-daily cadence. The engine binaries ride alongside in the Platform subfolder, with MpCmdRun.exe as the command-line updater. Versioned subfolders accumulate per update.
Stale definitions usually mean a broken update source, not a broken Defender. WSUS servers missing the KB approval, dead UNC shares, or a wedged Windows Update service all present as frozen intelligence dates. Manual packages from Microsoft's definition portal bypass all three for triage.
Where Windows stores this, by platform
C:\ProgramData\Microsoft\Windows Defender\Definition Updates
Versioned definition sets plus engine DLLs. Update via Windows Security, the definition portal packages, or MpCmdRun -SignatureUpdate elevated.
Frequently asked questions
Definitions will not update automatically. How do I force it?
Run MpCmdRun.exe -SignatureUpdate from an elevated prompt inside the newest Platform folder. Microsoft documents this as the fallback when Windows Update delivery stalls but manual packages work.
How do I check my current definition version?
Open Windows Security, Virus and threat protection, Protection updates, and read Security intelligence version plus Last updated. Compare against Microsoft's published current version to confirm freshness.
Notice an outdated path? Let us know.