[Fix] Protection definition update failed error code: 2147023293

Protection definition update failed with error code 2147023293 means Microsoft Defender downloaded new security intelligence but could not install it. The code is 0x80070643, Fatal error during installation. Most often the definition cache or the Defender platform is damaged, so start by clearing the cache and updating from an administrator Command Prompt.

Facts checked on 15 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What Protection definition update failed error code 2147023293 means

Protection definitions are what Microsoft now calls security intelligence: the list of known threats Microsoft Defender compares files with. Microsoft releases new ones several times a day. When Defender gets a package but cannot install it, Windows Security shows Protection definition update failed and a line such as Error code: -2147023293.

The number -2147023293 is the decimal form of 0x80070643. Windows Update shows the same failure in hexadecimal next to Security Intelligence Update for Microsoft Defender Antivirus - KB2267602. Windows' own text for 0x80070643 is Fatal error during installation, which is Windows error 1603.

• Not a download problem. The package arrived. The install step failed, so a faster connection does not help.
• Not a Windows feature update. The old guide and many readers think a normal Windows update failed. It is the Defender definitions, which Windows Update also delivers.
• Other codes you may see: users on Microsoft Q&A also report -2147023278 and -2147023083 for the same message. The fixes below are the same.

What causes error 2147023293, from most to least common

Most often the cached definitions are damaged, so the new package cannot be merged with them. Less often the Defender engine or platform files are broken after an earlier failed update, which also shows as version 0.0.0.0. Rarely another antivirus, a damaged Windows Update or damaged system files are behind it.

How to fix Protection definition update failed error code 2147023293

Fixes 1 and 2 take five minutes each and solve most cases. Fixes 3 and 4 repair Defender itself when the definitions have nothing to install into. Fixes 5 to 7 are for a PC where something else blocks Defender or Windows Update.

Fix 1. Clear the Defender definition cache and update again with MpCmdRun

5 minutesNo riskEveryone with error 2147023293. It is Microsoft's own first step for a definition update that fails.

Microsoft says a manually triggered update can address problems with automatic updates, and gives two commands that clear the current cache first. A damaged cached package is the most common reason the install step fails.

1. Select Start, type cmd, right-click Command Prompt and select Run as administrator.
2. Go to the Defender folder. MpCmdRun.exe is not in the PATH, so the commands fail without this step.

   cd /d "%ProgramFiles%\Windows Defender"

3. Clear the dynamic definitions from the cache.

   MpCmdRun.exe -removedefinitions -dynamicsignatures

4. Download and install the latest definitions.

   MpCmdRun.exe -SignatureUpdate

5. Open Windows Security > Virus & threat protection > Protection updates and select Check for updates.

Fix 2. Install the latest security intelligence package from Microsoft by hand

5 to 10 minutesNo riskFix 1 failed, or Windows Update keeps showing KB2267602 as failed.

Microsoft publishes the full definitions as one file that installs without Windows Update. It skips the delta packages and the update queue that fail with 0x80070643.

1. Open Microsoft's page Latest security intelligence updates for Microsoft Defender Antivirus (link in the sources).
2. In the table, find Microsoft Defender Antivirus for Windows 11, Windows 10, Windows 8.1, and Windows Server.
3. Select 64-bit on 64-bit Windows, ARM on an ARM PC, or 32-bit on 32-bit Windows.
4. Run the downloaded file. Microsoft names it mpam-fe.exe or mpam-feX64.exe and says you simply launch it. It shows no window.
5. Wait a minute, then open Protection updates and read the version and date.

Fix 3. Reset the Defender engine, definitions and platform with Microsoft's commands

10 minutesLow riskFixes 1 and 2 failed, or Protection updates shows version 0.0.0.0.

A failed earlier update can leave the engine half replaced, and then every new definition package fails to install. Microsoft's repair removes the definitions and engine, returns the platform to the copy that ships with Windows and downloads everything fresh.

1. Open Command Prompt as administrator, as in Fix 1.
2. Go to the Defender folder.

   cd /d "%ProgramFiles%\Windows Defender"

3. Remove the security intelligence and the engine.

   MpCmdRun.exe -RemoveDefinitions -All

4. Reset the platform.

   MpCmdRun.exe -ResetPlatform

5. Switch Defender on again.

   MpCmdRun.exe -WdEnable

6. Download fresh definitions straight from Microsoft.

   MpCmdRun.exe -SignatureUpdate -MMPC

7. Restart the PC and check Protection updates.

Microsoft's own command first looks for the newest folder under %ProgramData%\Microsoft\Windows Defender\Platform\ and falls back to %ProgramFiles%\Windows Defender. We use the fallback because it exists on every PC. For a Defender that reads 0.0.0.0 everywhere, see our guide Security Intelligence version 0.0.0.0.

Fix 4. Install the Defender platform update KB4052623 from the Microsoft Update Catalog

10 to 15 minutesLow riskThe reset ran, but the engine still reads 0.0.0.0 or every definition update still fails.

The platform holds the Defender service and the engine loader. In the accepted answer of the Microsoft Q&A thread on this exact error code, a user fixed it by installing the platform update KB4052623 by hand and then updating from the new platform folder.

1. Open the Microsoft Update Catalog at catalog.update.microsoft.com and search for KB4052623.
2. Pick the newest Update for Microsoft Defender Antivirus antimalware platform entry and select Download.
3. Save the files the download window lists to one folder, then run the .exe files. One that does not fit your PC says it is not compatible, which is normal.
4. Open C:\ProgramData\Microsoft\Windows Defender\Platform\ (type the path, the folder is hidden) and note the newest version folder.
5. In an administrator Command Prompt, go to that folder and update. Replace the folder name with the one you found.

   cd /d "C:\ProgramData\Microsoft\Windows Defender\Platform\<version folder>"
   MpCmdRun.exe -SignatureUpdate

6. Restart and check Protection updates.

We could not confirm the exact file names of the current platform release. Pick the .exe that matches your Windows (x64, x86 or ARM64). An installer for the wrong platform changes nothing.

Fix 5. Check that Defender is the active antivirus and its services run

10 to 30 minutesLow riskAnother antivirus is installed now or was before, even a trial that came with the PC, or Windows Security says the threat service has stopped.

Microsoft's repair steps say to uninstall non-Microsoft antivirus software when Defender is your main antivirus. A second product, or its leftover drivers, can keep Defender's services from installing updates.

1. Open Windows Security > Virus & threat protection. If another program is named as your antivirus, decide which one you want to keep.
2. Right-click Start and select Terminal (Admin). On Windows 10 select Windows PowerShell (Admin).
3. List the Defender services with Microsoft's command.

   Get-Service WinDefend, WdBoot, WdFilter, WdNisSvc, WdNisDrv, SecurityHealthService, wscsvc | Format-Table -Auto DisplayName, Name, StartType, Status

4. Microsoft expects WinDefend and wscsvc Automatic and Running, WdFilter Boot and Running, WdNisSvc Manual and Running, and WdBoot stopped after start-up.
5. If you want Defender back, uninstall the other antivirus, run its maker's removal tool, restart and run Fix 1 again.

1. Uninstall from the Start menu. Select Start > All apps and find the app. Right-click it (or press and hold) and select Uninstall.
2. Or uninstall in Settings. Select Start > Settings > Apps > Installed apps. Find the app, select More (the three dots) > Uninstall, and confirm.
3. Or uninstall from Control Panel. Some programs can only be removed here. Type Control Panel in the search box on the taskbar and open it, then select Programs > Programs and Features. Right-click the program and select Uninstall or Uninstall/Change, then follow the program's own uninstaller.
4. Restart if the uninstaller asks. Some programs finish removing their files only after a restart.

These steps were written for Windows 11 24H2 and 25H2. The full page with the other versions and what each result means: Uninstall a program or app in Windows

Fix 6. Repair Windows Update when other updates fail too

15 to 20 minutesLow riskWindows Update fails for other updates as well, not only for KB2267602.

Automatic definition updates come through Windows Update. Microsoft's definitions page points to the Windows Update troubleshooter when Windows Update has problems. A reset of its components clears a stuck download queue.

Run the troubleshooter first: Run the Windows Update troubleshooter

1. Open Command Prompt as administrator. Type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.
2. Stop the update services. Type the commands below and press Enter after each one. If Windows says that other services depend on Cryptographic Services, it stops them too. A message that a service is not started is fine.

   net stop wuauserv
   net stop bits
   net stop cryptsvc

   

3. Delete the download queue files. This clears the list of downloads that the Background Intelligent Transfer Service keeps. If Windows says it cannot find the files, continue.

   del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat"

4. Rename the update cache folders. Renaming keeps a copy in case you need it; Windows creates new, empty folders when the services start again. If you get Access is denied, a service is still running: repeat the previous step.

   ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
   ren %systemroot%\System32\catroot2 catroot2.old

   

5. Start the services again. Type the commands below and press Enter after each one. The requested service has already been started is fine: Windows started it on its own.

   net start cryptsvc
   net start bits
   net start wuauserv

   

6. Restart and check for updates. Restart the PC. Then select Start > Settings > Windows Update > Check for updates. The first check can take longer than usual because everything is downloaded again.

These steps were written for Windows 11 and Windows 10 (the steps are the same). The full page with the other versions and what each result means: Reset Windows Update components

1. Restart the PC.
2. Open Settings > Windows Update and select Check for updates.
3. Open Windows Security > Protection updates and check the version and date.

Fix 7. Repair Windows system files, then repair Windows in place

20 to 90 minutesLow riskFixes 1 to 6 did not help, and other Windows parts fail as well.

Defender and Windows Update rely on the component store and system files. DISM and SFC repair damaged files, and a repair install replaces Windows while keeping your apps and files. Users on Microsoft Q&A report that SFC often finds nothing for this error, so this is the last step.

1. Open an elevated command window. Right-click Start and select Terminal (Admin), or type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.

   

2. Run DISM first. Type the command below and press Enter. DISM downloads clean copies of damaged components from Windows Update, so it can take several minutes. Wait until it says The operation completed successfully.

   DISM.exe /Online /Cleanup-Image /RestoreHealth

   

3. Run System File Checker. In the same window, type the command below and press Enter. Do not close the window until the verification reaches 100%.

   sfc /scannow

   

4. Read the result and restart. Compare the last message with the table below this guide, then restart the PC so that repaired files are loaded.

   

These steps were written for Windows 11 24H2 and 25H2. The full page with the other versions and what each result means: Run DISM and SFC to repair Windows system files

1. Restart and run Fix 1 again.
2. If it still fails on Windows 11, open Settings > System > Recovery and select Reinstall now next to Fix problems using Windows Update.
3. Keep the PC plugged in and online until it restarts into Windows, then run Fix 1.

Routes for Windows 10 and other options: Reinstall Windows without losing files. Windows 10 left support on 14 October 2025. Microsoft still lists Defender definitions for it, but Windows itself gets no fixes without Extended Security Updates.

If the definition update still fails: the logs to read and what to send

When nothing helps, stop changing settings and collect evidence. Defender writes failed updates into its event log, and MpCmdRun writes every command it ran.

• What to send to Microsoft support: a screenshot of Protection updates, the output of the services command in Fix 5, the Windows build from winver and the failed update events.
• If Defender keeps switching itself off, run a full malware scan once it updates again: How to scan for malware with Microsoft Defender
• Is it hardware? Almost never. Suspect the drive only if SFC finds new damage after every repair: Check a disk for errors (chkdsk)

How to keep Defender definition updates from failing again

Frequently asked questions

What does Protection definition update failed mean?

It means Microsoft Defender could not install a new set of security intelligence, the definitions it uses to recognise threats. The download usually worked, but the install step failed, and Windows Security shows an error code such as -2147023293. Defender keeps working with the last definitions that installed, so it misses newer threats. Clear the cache and update with MpCmdRun (Fix 1), or install the mpam-fe.exe package from Microsoft by hand (Fix 2).

What is error code 2147023293 or -2147023293?

It is the decimal form of 0x80070643. Windows Security shows the decimal number, often with a minus sign, and Windows Update history shows the hexadecimal one. Windows' own text for 0x80070643 is Fatal error during installation, which is Windows error 1603. For this message it means the definition package did not install into Defender. The fixes on this page apply to every spelling of the code.

How do I fix Protection definition update failed on Windows 11?

The steps are the same on Windows 11 and Windows 10. Open Command Prompt as administrator, run cd /d "%ProgramFiles%\Windows Defender", then MpCmdRun.exe -removedefinitions -dynamicsignatures and MpCmdRun.exe -SignatureUpdate (Fix 1). If that fails, run the mpam-fe.exe package from Microsoft's definitions page (Fix 2). If the version shows 0.0.0.0, reset the platform with Microsoft's commands (Fix 3). Windows 11 only differs in menu names, for example Terminal (Admin).

Does this error also happen on Windows 10?

Yes. The first reports on Microsoft Q&A came from Windows 10 PCs in 2022, and the fixes on this page work there with the same commands. On Windows 10, open Windows PowerShell (Admin) where this page says Terminal (Admin). Keep in mind that Windows 10 left support on 14 October 2025. Microsoft still publishes Defender definitions for it, but Windows itself gets no fixes without Extended Security Updates.

Is KB2267602 failing with 0x80070643 the same problem?

Yes. KB2267602 is the Windows Update name of the Defender security intelligence update. When it fails with 0x80070643, Windows Security shows the same failure as Protection definition update failed, error code -2147023293. Retrying through Windows Update often fails again with the same code. Install the definitions directly instead, with MpCmdRun (Fix 1) or the mpam-fe.exe package (Fix 2). If other updates also fail, repair Windows Update (Fix 6).

Can I fix it without resetting or reinstalling Windows?

Yes, in almost every case. The old advice to reset the PC or run a repair upgrade is far more than this error needs. The definitions live in Defender's own folders, and Microsoft's commands clear and rebuild them in minutes (Fixes 1 to 3). Only if Windows Update and system files are damaged too should you repair Windows in place, which keeps your apps and files (Fix 7). Back up your files before any repair install.

Is my PC unprotected while the definition update fails?

Not fully, but it is behind. Defender keeps using the last definitions that installed, so it still detects older threats. It does not know threats released since. Open Windows Security, Virus & threat protection, Protection updates, and read the date under Version created on. If it is more than a day or two old, fix the update before you open unknown attachments or downloads.

Should I reinstall the Windows Security app with Get-AppxPackage?

Usually not. The old guide suggested re-registering the Windows Security app with a Get-AppxPackage SecHealthUI command. That repairs the Windows Security window, not the Defender engine or its definitions, and the window only shows what the Defender service reports. Users on Microsoft Q&A also report that the command gives errors on some PCs. Use it only if the window itself is blank or will not open, and fix the definitions with Fixes 1 to 3.

This page is about which error, exactly?

This page is about one message in Microsoft Defender: Protection definition update failed, with error code 2147023293 or 0x80070643. Searches such as fix update definition, error definition update or meaning update error brought some readers here. If your message names another code, the first three fixes still help with most Defender definition errors, but search that code on its own for its specific cause.