How to Update Windows Defender (Manual, Automatic, Offline)

This is the fastest answer for searches like how do i update windows defender, how can i update windows defender, and updating windows defender. For most devices, the built-in Windows Security path is the easiest manual option.

Windows Defender updates are not all the same. The most common updates are definitions, but users may also see engine or platform updates.

The simple rule is that definitions change often, while engine and platform updates are broader product updates. That is why one device can be current on threat definitions but still receive a separate Defender platform update later.

If you are troubleshooting the recurring Defender intelligence update specifically, continue to KB2267602.

You can manually update Windows Defender through Windows Security or by triggering a Defender signature update command.

1. Open Windows Security.
2. Select Virus & threat protection.
3. Open Protection updates.
4. Select Check for updates.

If you prefer a command-based manual check, a common built-in option is Update-MpSignature. That is useful when you want to trigger a definition refresh without working through the Windows Security screens.

This is the practical answer for users who want a manual Defender refresh without waiting for the normal background cycle.

Windows Defender offline update is the manual method used when a device cannot get current definitions from the normal online path.

Windows Defender offline updates allow systems without internet access to receive updated definitions manually. This is most useful for isolated devices, restricted networks, or systems where the normal update path is not working yet.

The high-level workflow is simple:

1. Get the correct offline Defender update package from Microsoft's official Defender update source.
2. Move it to the target device.
3. Run the package on that device.
4. Check Defender status again to confirm the update was accepted.

Microsoft publishes the manual and offline packages through its official Defender update source, which is the right place to confirm the current package rather than relying on third-party downloads.

This is where many users get confused. Windows Update and Windows Defender updates are related, but they are not always the same thing.

• Windows Update: broader operating system update workflow.
• Windows Defender updates: security intelligence, engine, and platform updates for Microsoft Defender.

That means a device can show recent Windows Update activity without having the newest Defender definitions yet, or vice versa. If you need to review the general Windows path too, see how to check for Windows updates.

Update for Windows security platform explained

An update for Windows security platform usually refers to a Defender platform update rather than a normal definition refresh.

For the current Defender package types and release behavior, use Microsoft's Defender update guidance.

In simple terms, definitions tell Defender what to detect, while a platform update affects more of the Defender product framework itself. That is why the wording looks different from standard security intelligence updates.

Users often notice this label and assume it is just another definition update, but it usually signals a broader Defender component update.

If Defender is not updating, the cause is usually one of a few practical problems:

• No internet connection: the device cannot reach Microsoft's update source.
• Offline or isolated endpoint: the normal cloud path is unavailable.
• Windows Update service or security service issues: update-related components are stale or unhealthy.
• Managed device restrictions: policy or management settings are shaping the behavior.
• Status mismatch: Windows Update and Defender views are not showing the same moment in time.

If the broader Windows servicing path also looks wrong, continue to Windows Update fails to install or Windows Update logs.

The simplest check is to open Windows Security, review the current protection update information, and confirm the device does not show stale or failed update status.

A practical verification flow looks like this:

1. Open Windows Security.
2. Go to Virus & threat protection.
3. Open Protection updates.
4. Review whether the definitions look current and whether the last update completed successfully.

If you also need to compare that result with the general OS update path, use Windows Update checks and manual Windows update guidance.

• Assuming a normal OS update means Defender definitions are already current.
• Ignoring offline or restricted devices that cannot refresh definitions normally.
• Treating definition updates and platform updates as if they were the same thing.
• Checking only Windows Update and not Windows Security.

One reason Defender update questions get confusing is that several states can exist at the same time.

• Update available: a newer Defender update exists.
• Update downloaded: the update package reached the device.
• Update applied: Defender accepted the newer definitions or platform package.
• Protection status current: Windows Security reports the protection layer is in a healthy current state.

Those are not always identical views. PatchReporter helps teams compare update evidence, reporting freshness, and actual endpoint status more clearly so the protection story is easier to explain across many devices.

How do I update Windows Defender?

Open Windows Security, go to Virus and threat protection, open Protection updates, and check for updates.

Can I update Windows Defender manually?

Yes. You can use the Windows Security update option or trigger a Defender signature update command.

What is Windows Defender offline update?

It is a manual way to apply newer Defender definitions to a device that cannot update normally over the internet.

Is Windows Defender updated through Windows Update?

Often yes, but Defender also has its own protection update flow, which is why the two views do not always look identical.

Why is my Defender not updating?

Common reasons include offline devices, stale services, management restrictions, or confusion between general Windows Update state and Defender-specific update state.