Share via

Windows Defender Antivirus has encountered an error trying to update signatures.

SpaceCaptain87 6 Reputation points
2022-10-11T21:31:31.023+00:00

Hello

I have a Server 2019 machine which is refusing to update or scan. If I try to remove updates and install new updates from powershell I get the following:

-------------------------------------------------------------------------------------

MpCmdRun: Command Line: "C:\Program Files\Windows Defender\MpCmdRun.exe" -removedefinitions -dynamicsignatures
Start Time: ‎Wed ‎Oct ‎12 ‎2022 09:02:29

MpEnsureProcessMitigationPolicy: hr = 0x1
Start: MpRemoveDefinitions(0)
ERROR: MpRollbackSignature failed with hr=800106BA
MpCmdRun: End Time: ‎Wed ‎Oct ‎12 ‎2022 09:02:29

-------------------------------------------------------------------------------------

-------------------------------------------------------------------------------------

MpCmdRun: Command Line: "C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate
Start Time: ‎Wed ‎Oct ‎12 ‎2022 09:02:53

MpEnsureProcessMitigationPolicy: hr = 0x1
Start: MpSignatureUpdate()
Calling MpUpdateStartEx with option 0x1
Update started
Update completed with hr: 0x800106ba
ERROR: Signature Update failed with hr=800106BA
MpCmdRun: End Time: ‎Wed ‎Oct ‎12 ‎2022 09:02:53

-------------------------------------------------------------------------------------

Service and Engine version are reporting as version 0.0.0.0

The Windows Defender Operational Event Logs are reporting event ID's 5007,2001

The Windows Defender ATP,Anti-Virus and Network inspection services are all set to manual and I cannot change them to automatic as the option is either greyed out or access is denied.

Any ideas on how I can resolve this?

Windows for business | Windows Client for IT Pros | Devices and deployment | Configure application groups
Windows for business | Windows Server | User experience | Other
0 comments

5 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. JardaB 20 Reputation points
    2023-08-29T16:36:49.9466667+00:00

    The same problem wit update Defender signature

    ========================================

    Microsoft Windows [Version 10.0.22621.2215]

    (c) Microsoft Corporation. Všechna práva vyhrazena.

    C:\Windows\System32>cd %ProgramFiles%\Windows Defender

    C:\Program Files\Windows Defender>MpCmdRun.exe -removedefinitions -dynamicsignatures

    Service Version: 0.0.0.0

    Engine Version: 0.0.0.0

    Starting Dynamic Signature removal.Failed! Error 0x800106ba

    Service Version: 0.0.0.0

    Engine Version: 0.0.0.0

    CmdTool: Failed with hr = 0x800106ba. Check C:\Users\admin\AppData\Local\Temp\MpCmdRun.log for more information

    C:\Program Files\Windows Defender>MpCmdRun.exe -SignatureUpdate

    Signature update started . . .

    Service Version: 0.0.0.0

    Engine Version: 0.0.0.0

    ERROR: Signature Update failed with hr=0x800106ba

    CmdTool: Failed with hr = 0x800106ba. Check C:\Users\admin\AppData\Local\Temp\MpCmdRun.log for more information

    C:\Program Files\Windows Defender>clear

    'clear' is not recognized as an internal or external command,

    operable program or batch file.

    C:\Program Files\Windows Defender>Run sfc /scannow

    'Run' is not recognized as an internal or external command,

    operable program or batch file.

    C:\Program Files\Windows Defender>DISM /Online /Cleanup-Image /CheckHealth

    Deployment Image Servicing and Management tool

    Version: 10.0.22621.1

    Image Version: 10.0.22621.2215

    No component store corruption detected.

    The operation completed successfully.

    C:\Program Files\Windows Defender>DISM /Online /Cleanup-Image /ScanHealth

    Deployment Image Servicing and Management tool

    Version: 10.0.22621.1

    Image Version: 10.0.22621.2215

    [==========================100.0%==========================] No component store corruption detected.

    The operation completed successfully.

    C:\Program Files\Windows Defender>DISM /Online /Cleanup-Image /RestoreHealth

    Deployment Image Servicing and Management tool

    Version: 10.0.22621.1

    Image Version: 10.0.22621.2215

    [==========================100.0%==========================] The restore operation completed successfully.

    The operation completed successfully.

    C:\Program Files\Windows Defender>C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate

    'C:\Program' is not recognized as an internal or external command,

    operable program or batch file.

    C:\Program Files\Windows Defender>"C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate

    Signature update started . . .

    Service Version: 0.0.0.0

    Engine Version: 0.0.0.0

    ERROR: Signature Update failed with hr=0x800106ba

    CmdTool: Failed with hr = 0x800106ba. Check C:\Users\admin\AppData\Local\Temp\MpCmdRun.log for more information

    C:\Program Files\Windows Defender>"C:\Program Files\Windows Defender\MSASCui.exe" -Update

    '"C:\Program Files\Windows Defender\MSASCui.exe"' is not recognized as an internal or external command,

    operable program or batch file.

    C:\Program Files\Windows Defender>

    0 comments
  2. SpaceCaptain87 6 Reputation points
    2022-11-02T20:23:34.227+00:00

    Well unless I can find some sort of solution, it looks like I will have to rebuild the DC, which is very annoying.

    0 comments
  3. SpaceCaptain87 6 Reputation points
    2022-10-18T20:33:54.957+00:00

    Thanks for your reply. Unfortunately that doesn't work

    Sfc /scannow reported no problems. As with the DISM commands:

    C:\Windows\system32>DISM /Online /Cleanup-Image /CheckHealth

    Deployment Image Servicing and Management tool
    Version: 10.0.17763.3406

    Image Version: 10.0.17763.3406

    No component store corruption detected.
    The operation completed successfully.

    C:\Windows\system32>DISM /Online /Cleanup-Image /ScanHealth

    Deployment Image Servicing and Management tool
    Version: 10.0.17763.3406

    Image Version: 10.0.17763.3406

    [==========================100.0%==========================] No component store corruption detected.
    The operation completed successfully.

    C:\Windows\system32>DISM /Online /Cleanup-Image /RestoreHealth

    Deployment Image Servicing and Management tool
    Version: 10.0.17763.3406

    Image Version: 10.0.17763.3406

    [==========================100.0%==========================] The restore operation completed successfully.

    Also

    C:\Program Files\Windows Defender>.\MpCmdRun.exe -SignatureUpdate
    Signature update started . . .
    ERROR: Signature Update failed with hr=800106BA
    CmdTool: Failed with hr = 0x800106BA. Check C:\Users\administrator\AppData\Local\Temp\MpCmdRun.log for more information

    The executable MSASCui.exe does not exist on the server.

    0 comments
  4. Limitless Technology 45,226 Reputation points
    2022-10-18T07:16:00.917+00:00

    Hello

    Thank you for your question and reaching out. I can understand you are having issues related to Defender updates.

    1. Run sfc /scannow
    2. Run below DISM commands from elevated prompt.

    DISM /Online /Cleanup-Image /CheckHealth
    DISM /Online /Cleanup-Image /ScanHealth
    DISM /Online /Cleanup-Image /RestoreHealth

    1. Copy, paste, and run this command at the Windows Command Prompt with elevated

    “C:\Program Files\Windows Defender\MpCmdRun.exe” -SignatureUpdate

    “C:\Program Files\Windows Defender\MSASCui.exe” -Update

    ----------------------------------------------------------------------------------------------------------------------------------------------

    --If the reply is helpful, please Upvote and Accept as answer--

  5. SpaceCaptain87 6 Reputation points
    2022-10-16T19:47:41.527+00:00

    Bump. Any troubleshooting tips appreciated...

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.