PatchReporter

Docs

KB2267602: What It Is, Download, and Fix Failed Install

Learn what KB2267602 is, why it installs often, how to download it manually or offline, and how to fix common failed install issues.

Category: Troubleshooting | Published 2026-03-21 | Updated 2026-03-21

Informational for Windows users, IT teams, and MSPs trying to understand KB2267602, why it appears frequently, and how to troubleshoot failed Defender definition updates

Free Audit

Run The Free Audit

If you need to separate stale scans, reboot debt, failure signals, and real patch risk across endpoints, run the free RMM Patch Health Audit.

Run the free audit

KB2267602 is the recurring Microsoft Defender Antivirus security intelligence update that refreshes virus definitions and related protection data on Windows systems. It appears often because Defender definitions are updated much more frequently than normal monthly Windows patches.

That frequency is also why KB2267602 causes so much confusion. Users may see it install repeatedly, fail once and then succeed later, or appear in Windows Update even though the device still looks protected in Windows Security. This page explains what KB2267602 is, how to download or update it manually, and how to troubleshoot failed installs.

Use Microsoft's Defender update guidance as the primary reference for security intelligence updates, manual download options, and product update behavior. Microsoft Defender Antivirus security intelligence and product updates

What You'll Get

  • Understand what KB2267602 is and why it shows up so often in Windows Update history
  • Use the right path for manual or offline Defender definition updates when the normal update flow is not working
  • Separate real KB2267602 installation problems from confusing status or retry behavior

What is KB2267602

Direct answer: KB2267602 is a Microsoft Defender Antivirus security intelligence update that updates virus definitions and protection data on Windows systems.

It is not a normal once-a-month cumulative update. It is a recurring Defender update, which is why it can appear in Windows Update history over and over again.

This is the main answer for searches like what is kb2267602, kb2267602 update, kb2267602 windows update, and windows defender kb2267602. The update is tied to Microsoft Defender protection data, not a full operating system release.

What KB2267602 actually does

Security intelligence update for Microsoft Defender Antivirus KB2267602 refreshes the threat detection content Defender uses to recognize current malware and suspicious activity.

In plain language, it updates the Defender protection data that changes often as Microsoft publishes newer intelligence. That is why KB2267602 behaves more like an ongoing Defender content update than a one-time Windows patch.

The most important point is that KB2267602 is mainly about definitions and protection data, not a major platform change by itself.

Why KB2267602 installs so often

KB2267602 appears frequently because Defender definitions are updated regularly, sometimes many times over the life of a device.

That is normal behavior. Defender threat intelligence changes more often than normal monthly Windows servicing, so a device can show repeated KB2267602 entries over time without anything being wrong.

This is why users often think KB2267602 is "stuck in a loop" when the real issue is that a newer Defender intelligence package replaced the older one quickly.

KB2267602 failed to install

If KB2267602 failed, KB2267602 failed to install, or KB2267602 won't install, start with the simplest explanation first: Defender updates are frequent and sometimes one attempt fails before a later retry succeeds.

That matters for searches like kb2267602 error 0x80070643, kb2267602 stuck, and kb2267602 not installing. A failed entry in Windows Update history does not always mean Defender is currently out of date.

  1. Retry the update. A later definition refresh often succeeds cleanly.
  2. Check Defender status directly. Look at the current protection update information in Windows Security.
  3. Restart the device if needed. A stale service or pending state can block the next attempt.
  4. Use a manual Defender update path. If normal updating still fails, switch to the Defender manual update route.

Error 0x80070643 is especially confusing here because it can appear during Defender update retries even when the next definition update succeeds later. The practical question is not just "did one attempt fail?" It is "is Defender current now?"

Caution: a failed KB2267602 entry in Windows Update history does not always mean Defender is currently out of date. Check current Defender protection status before treating one failed attempt as the final state.

How to download KB2267602 manually

KB2267602 manual download usually means getting the current official Defender security intelligence package from Microsoft's Defender update source instead of waiting only on Windows Update.

This is the practical path for searches like kb2267602 download, download kb2267602, and kb2267602 manual download. If the built-in update path looks stale or blocked, a manual Defender package can be the cleaner next step.

At a high level:

  1. Use Microsoft's official Defender update source.
  2. Choose the package that matches the target device.
  3. Run the update package.
  4. Check Defender status again after the install.

If you first need the broader Defender update overview, see how to update Windows Defender.

KB2267602 offline update

KB2267602 offline download is the right concept when the device cannot get current Defender definitions through the normal internet-connected update path.

This is most useful for isolated devices, restricted networks, or systems where normal Defender updating is not working correctly. The basic workflow is to download the official offline Defender update package somewhere else, move it to the target machine, and run it locally.

If you need that package, use Microsoft's official Defender update source rather than a mirrored third-party download.

That makes KB2267602 offline updating a Defender maintenance task, not just a Windows Update troubleshooting trick.

Why KB2267602 shows as failed but still updates

This is one of the most common confusion points with KB2267602.

A device can show a failed KB2267602 entry in Windows Update history and still end up with current Defender protection later. That happens because Defender intelligence updates are frequent, retries are normal, and the next successful update may arrive quickly enough that the protection state is already current even though the earlier attempt failed.

That is the real operational edge with KB2267602: Windows Update history and current Defender protection state are not always the same thing.

How to verify KB2267602 installed correctly

The practical goal is to verify current Defender protection state, not just read one failed or successful Windows Update row in isolation.

  1. Open Windows Security.
  2. Go to Virus & threat protection.
  3. Review the current protection update information.
  4. Confirm the device no longer looks stale.

If the Defender view still looks old or broken, move next to a manual or offline Defender update instead of relying only on another automatic retry.

Common problems with KB2267602

  • The update appears repeatedly and looks like a loop even though it is normal Defender behavior.
  • Windows Update history shows one failed attempt even though Defender later updated successfully.
  • Offline or restricted devices cannot refresh definitions through the normal path.
  • Error 0x80070643 creates noise that looks worse than the current protection state really is.
  • Users confuse Defender definition updates with broader Windows platform updates.

Why update status may not match actual protection state

One reason KB2267602 is so confusing is that several different states can be true at once.

  • Update attempted: Windows tried to apply a Defender intelligence update.
  • Update failed: one attempt did not complete cleanly.
  • Newer definition applied: a later Defender update succeeded.
  • Protection current: Defender is still using a current protection set.

Those are not identical. PatchReporter helps teams compare reported update state, endpoint evidence, and protection freshness more clearly so recurring Windows security updates are easier to explain across many devices.

FAQ

What is KB2267602?

KB2267602 is a Microsoft Defender Antivirus security intelligence update that updates virus definitions and protection data on Windows systems.

Why does KB2267602 keep installing?

Because Defender definitions are updated frequently, KB2267602 can appear over and over as newer protection data is published.

Why does KB2267602 fail?

It can fail because of temporary update issues, stale services, offline devices, or simple retry behavior where a later Defender update succeeds anyway.

How do I fix KB2267602 error 0x80070643?

Retry first, check Defender status directly, restart if needed, and use a manual or offline Defender update path if the normal update flow stays stuck.

Can I download KB2267602 manually?

Yes. You can use Microsoft's official Defender update source for manual or offline security intelligence updates.

FAQ

What is KB2267602?

KB2267602 is a Microsoft Defender Antivirus security intelligence update that refreshes virus definitions and protection data on Windows systems.

Why does KB2267602 keep installing?

It appears often because Defender definitions are updated frequently, sometimes multiple times, as threat intelligence changes.

Why does KB2267602 fail?

Common reasons include temporary Defender update issues, stale services, offline devices, retry behavior, or a mismatch between Windows Update status and actual Defender protection state.

How do I fix KB2267602 error 0x80070643?

Start by retrying the update, then check Defender update status directly, restart the device if needed, and use a manual or offline Defender update path if the normal update flow stays stuck.

Can I download KB2267602 manually?

Yes. You can use the official Microsoft Defender update source for manual or offline security intelligence updates instead of waiting only on the normal Windows Update path.

Verify Security Update State More Clearly

PatchReporter helps teams compare update status, endpoint evidence, and reporting freshness so recurring Windows security updates are easier to validate across many devices.

See PatchReporter features

Related Docs

Browse all docs or see product features.