diff --git a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md index 6c77863dbb..c2ef299832 100644 --- a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md +++ b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md @@ -29,216 +29,264 @@ The Group Policy setting **Turn on PIN sign-in** does not apply to Windows 10. The following table lists the Group Policy settings that you can configure for Passport use in your workplace. These policy settings are available in **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **Microsoft Passport for Work**. -Policy -Options -Use Microsoft Passport for Work -**Not configured**: Users can provision Passport for Work, which encrypts their domain password. - -**Enabled**: Device provisions Passport for Work using keys or certificates for all users. - -**Disabled**: Device does not provision Passport for Work for any user. - -Use a hardware security device -**Not configured**: Passport for Work will be provisioned using TPM if available, and will be provisioned using software if TPM is not available. - -**Enabled**: Passport for Work will only be provisioned using TPM. - -**Disabled**: Passport for Work will be provisioned using TPM if available, and will be provisioned using software if TPM is not available. - -Use biometrics -**Not configured**: Biometrics can be used as a gesture in place of a PIN. - -**Enabled**: Biometrics can be used as a gesture in place of a PIN. - -**Disabled**: Only a PIN can be used as a gesture. - -PIN Complexity -Require digits -**Not configured**: Users must include a digit in their PIN. - -**Enabled**: Users must include a digit in their PIN. - -**Disabled**: Users cannot use digits in their PIN. - -Require lowercase letters -**Not configured**: Users cannot use lowercase letters in their PIN. - -**Enabled**: Users must include at least one lowercase letter in their PIN. - -**Disabled**: Users cannot use lowercase letters in their PIN. - -Maximum PIN length -**Not configured**: PIN length must be less than or equal to 127. - -**Enabled**: PIN length must be less than or equal to the number you specify. - -**Disabled**: PIN length must be less than or equal to 127. - -Minimum PIN length -**Not configured**: PIN length must be greater than or equal to 4. - -**Enabled**: PIN length must be greater than or equal to the number you specify. - -**Disabled**: PIN length must be greater than or equal to 4. - -Expiration -**Not configured**: PIN does not expire. - -**Enabled**: PIN can be set to expire after any number of days between 1 and 730, or PIN can be set to never expire by setting policy to 0. - -**Disabled**: PIN does not expire. - -History -**Not configured**: Previous PINs are not stored. - -**Enabled**: Specify the number of previous PINs that can be associated to a user account that can't be reused. - -**Disabled**: Previous PINs are not stored. - -**Note**  Current PIN is included in PIN history. - -  - -Require special characters -**Not configured**: Users cannot include a special character in their PIN. - -**Enabled**: Users must include at least one special character in their PIN. - -**Disabled**: Users cannot include a special character in their PIN. - -Require uppercase letters -**Not configured**: Users cannot include an uppercase letter in their PIN. - -**Enabled**: Users must include at least one uppercase letter in their PIN. - -**Disabled**: Users cannot include an uppercase letter in their PIN. - -[Remote Passport](prepare-people-to-use-microsoft-passport.md#bmk-remote) -Use Remote Passport - -**Note**  Applies to desktop only. Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants. - -  - -**Not configured**: Remote Passport is disabled. - -**Enabled**: Users can use a portable, registered device as a companion device for desktop authentication. - -**Disabled**: Remote Passport is disabled. - -  - -## MDM policy settings for Passport - - -The following table lists the MDM policy settings that you can configure for Passport use in your workplace. These MDM policy settings use the [PassportForWork configuration service provider (CSP)](http://go.microsoft.com/fwlink/p/?LinkId=692070). - -Policy -Scope -Default -Options -UsePassportForWork -Device -True -True: Passport will be provisioned for all users on the device. - -False: Users will not be able to provision Passport. - -**Note**  If Passport is enabled, and then the policy is changed to False, users who previously set up Passport can continue to use it, but will not be able to set up Passport on other devices. - -  - -RequireSecurityDevice -Device -False -True: Passport will only be provisioned using TPM. - -False: Passport will be provisioned using TPM if available, and will be provisioned using software if TPM is not available. - -Biometrics -UseBiometrics - -Device -False -True: Biometrics can be used as a gesture in place of a PIN for domain logon. - -False: Only a PIN can be used as a gesture for domain logon. - -FacialFeaturesUser - -EnhancedAntiSpoofing - -Device -Not configured -Not configured: users can choose whether to turn on enhanced anti-spoofing. - -True: Enhanced anti-spoofing is required on devices which support it. - -False: Users cannot turn on enhanced anti-spoofing. - -PINComplexity -Digits -Device or user -2 -1: Numbers are not allowed. - -2: At least one number is required. - -Lowercase letters -Device or user -1 -1: Lowercase letters are not allowed. - -2: At least one lowercase letter is required. - -Maximum PIN length -Device or user -127 -Maximum length that can be set is 127. Maximum length cannot be less than minimum setting. - -Minimum PIN length -Device or user -4 -Minimum length that can be set is 4. Minimum length cannot be greater than maximum setting. - -Expiration -Device or user -0 -Integer value specifies the period of time (in days) that a PIN can be used before the system requires the user to change it. The largest number you can configure for this policy setting is 730. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then the user’s PIN will never expire. - -History -Device or user -0 -Integer value that specifies the number of past PINs that can be associated to a user account that can’t be reused. The largest number you can configure for this policy setting is 50. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then storage of previous PINs is not required. - -Special characters -Device or user -1 -1: Special characters are not allowed. - -2: At least one special character is required. - -Uppercase letters -Device or user -1 -1: Uppercase letters are not allowed - -2: At least one uppercase letter is required - -Remote -UseRemotePassport - -**Note**  Applies to desktop only. Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants. - -  - -Device or user -False -True: [Remote Passport](prepare-people-to-use-microsoft-passport.md#bmk-remote) is enabled. - -False: [Remote Passport](prepare-people-to-use-microsoft-passport.md#bmk-remote) is disabled. - -  + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
PolicyOptions
Use Microsoft Passport for Work +

Not configured: Users can provision Passport for Work, which encrypts their domain password.

+

Enabled: Device provisions Passport for Work using keys or certificates for all users.

+

Disabled: Device does not provision Passport for Work for any user.

+
Use a hardware security device +

Not configured: Passport for Work will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.

+

Enabled: Passport for Work will only be provisioned using TPM.

+

Disabled: Passport for Work will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.

+
Use biometrics +

Not configured: Biometrics can be used as a gesture in place of a PIN.

+

Enabled: Biometrics can be used as a gesture in place of a PIN.

+

Disabled: Only a PIN can be used as a gesture.

+
PIN ComplexityRequire digits +

Not configured: Users must include a digit in their PIN.

+

Enabled: Users must include a digit in their PIN.

+

Disabled: Users cannot use digits in their PIN.

+
Require lowercase letters +

Not configured: Users cannot use lowercase letters in their PIN.

+

Enabled: Users must include at least one lowercase letter in their PIN.

+

Disabled: Users cannot use lowercase letters in their PIN.

+
Maximum PIN length +

Not configured: PIN length must be less than or equal to 127.

+

Enabled: PIN length must be less than or equal to the number you specify.

+

Disabled: PIN length must be less than or equal to 127.

+
Minimum PIN length +

Not configured: PIN length must be greater than or equal to 4.

+

Enabled: PIN length must be greater than or equal to the number you specify.

+

Disabled: PIN length must be greater than or equal to 4.

+
Expiration +

Not configured: PIN does not expire.

+

Enabled: PIN can be set to expire after any number of days between 1 and 730, or PIN can be set to never expire by setting policy to 0.

+

Disabled: PIN does not expire.

+
History +

Not configured: Previous PINs are not stored.

+

Enabled: Specify the number of previous PINs that can be associated to a user account that can't be reused.

+

Disabled: Previous PINs are not stored.

+
Note  Current PIN is included in PIN history.
+
 
+
Require special characters +

Not configured: Users cannot include a special character in their PIN.

+

Enabled: Users must include at least one special character in their PIN.

+

Disabled: Users cannot include a special character in their PIN.

+
Require uppercase letters +

Not configured: Users cannot include an uppercase letter in their PIN.

+

Enabled: Users must include at least one uppercase letter in their PIN.

+

Disabled: Users cannot include an uppercase letter in their PIN.

+
Remote Passport +

Use Remote Passport

+
Note  Applies to desktop only. Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants.
+
 
+
+

Not configured: Remote Passport is disabled.

+

Enabled: Users can use a portable, registered device as a companion device for desktop authentication.

+

Disabled: Remote Passport is disabled.

+
+

 

+

MDM policy settings for Passport

+

The following table lists the MDM policy settings that you can configure for Passport use in your workplace. These MDM policy settings use the PassportForWork configuration service provider (CSP).

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
PolicyScopeDefaultOptions
UsePassportForWorkDeviceTrue +

True: Passport will be provisioned for all users on the device.

+

False: Users will not be able to provision Passport.

+
Note  If Passport is enabled, and then the policy is changed to False, users who previously set up Passport can continue to use it, but will not be able to set up Passport on other devices.
+
 
+
RequireSecurityDeviceDeviceFalse +

True: Passport will only be provisioned using TPM.

+

False: Passport will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.

+
Biometrics +

UseBiometrics

+
Device False +

True: Biometrics can be used as a gesture in place of a PIN for domain logon.

+

False: Only a PIN can be used as a gesture for domain logon.

+
+

FacialFeaturesUser

+

EnhancedAntiSpoofing

+
DeviceNot configured +

Not configured: users can choose whether to turn on enhanced anti-spoofing.

+

True: Enhanced anti-spoofing is required on devices which support it.

+

False: Users cannot turn on enhanced anti-spoofing.

+
PINComplexity
Digits Device or user2 +

1: Numbers are not allowed.

+

2: At least one number is required.

+
Lowercase letters Device or user1 +

1: Lowercase letters are not allowed.

+

2: At least one lowercase letter is required.

+
Maximum PIN length Device or user127 +

Maximum length that can be set is 127. Maximum length cannot be less than minimum setting.

+
Minimum PIN lengthDevice or user4 +

Minimum length that can be set is 4. Minimum length cannot be greater than maximum setting.

+
Expiration Device or user0 +

Integer value specifies the period of time (in days) that a PIN can be used before the system requires the user to change it. The largest number you can configure for this policy setting is 730. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then the user’s PIN will never expire. +

+
HistoryDevice or user0 +

Integer value that specifies the number of past PINs that can be associated to a user account that can’t be reused. The largest number you can configure for this policy setting is 50. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then storage of previous PINs is not required. +

+
Special charactersDevice or user1 +

1: Special characters are not allowed.

+

2: At least one special character is required.

+
Uppercase lettersDevice or user1 +

1: Uppercase letters are not allowed

+

2: At least one uppercase letter is required

+
Remote +

UseRemotePassport

+
Note  Applies to desktop only. Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants.
+
 
+
Device or userFalse +

True: Remote Passport is enabled.

+

False: Remote Passport is disabled.

+
**Note**   If policy is not configured to explicitly require letters or special characters, users will be restricted to creating a numeric PIN. diff --git a/windows/keep-secure/troubleshoot-windows-defender-for-windows-10.md b/windows/keep-secure/troubleshoot-windows-defender-for-windows-10.md index c926b7d396..e8cb3b642b 100644 --- a/windows/keep-secure/troubleshoot-windows-defender-for-windows-10.md +++ b/windows/keep-secure/troubleshoot-windows-defender-for-windows-10.md @@ -39,1396 +39,2608 @@ Use the information in this table to help troubleshoot Windows Defender client e You can find a complete list of the Microsoft antimalware *event IDs*, the symbol, and the description of each ID in [Windows Server Antimalware Events TechNet](https://technet.microsoft.com/library/dn913615.aspx). -  - -Event ID: 1000 -Symbolic name: - -**MALWAREPROTECTION\_SCAN\_STARTED** - -Message: - -**An antimalware scan started.** - -Description: - -Scan ID: -Scan Type: -Scan Parameters: -Scan Resources: -User: - -<ID number of the relevant scan.> -<Scan type>, for example: -Scan Parameters: -Scan Resources: -User: -Event ID: 1001 -Symbolic name: - -**MALWAREPROTECTION\_SCAN\_COMPLETED** - -Message: - -**An antimalware scan finished.** - -Description: - -Scan ID: -Scan Type: -Scan Parameters: -User: -Scan Time: -Event ID: 1002 -Symbolic name: - -**MALWAREPROTECTION\_SCAN\_CANCELLED** - -Message: - -**An antimalware scan was stopped before it finished.** - -Description: - -Scan ID: -Scan Type: -Scan Parameters: -User: -Scan Time: -Event ID: 1003 -Symbolic name: - -**MALWAREPROTECTION\_SCAN\_PAUSED** - -Message: - -**An antimalware scan was paused.** - -Description: - -Scan ID: -Scan Type: -Scan Parameters: -User: -Event ID: 1004 -Symbolic name: - -**MALWAREPROTECTION\_SCAN\_RESUMED** - -Message: - -**An antimalware scan was resumed.** - -Description: - -Scan ID: -Scan Type: -Scan Parameters: -User: -Event ID: 1005 -Symbolic name: - -**MALWAREPROTECTION\_SCAN\_FAILED** - -Message: - -**An antimalware scan failed.** - -Description: - -Scan ID: -Scan Type: -Scan Parameters: -User: -Error Code: -Error Description: -User action: - -The Windows Defender client encountered an error, and the current scan has stopped. The scan might fail due to a client-side issue. This event record includes the scan ID, type of scan (antivirus, antispyware, antimalware), scan parameters, the user that started the scan, the error code, and a description of the error. - -To troubleshoot this event: - -1. Run the scan again. -2. If it fails in the same way, go to the [Microsoft Support site](http://go.microsoft.com/fwlink/?LinkId=215163), enter the error number in the **Search** box to look for the error code. -3. Contact [Microsoft Technical Support](http://go.microsoft.com/fwlink/?LinkId=215491). - -Event ID: 1006 -Symbolic name: - -**MALWAREPROTECTION\_MALWARE\_DETECTED** - -Message: - -**The antimalware engine found malware or other potentially unwanted software.** - -Description: - -For more information please see the following: - -Name: -ID: -Severity: -Category -Path: -Detection Origin: -Detection Type: -Detection Source: -Status: -User: -Process Name: -Signature Version: -Engine Version: -Event ID: 1007 -Symbolic name: - -**MALWAREPROTECTION\_MALWARE\_ACTION\_TAKEN** - -Message: - -**The antimalware platform performed an action to protect your system from malware or other potentially unwanted software.** - -Description: - -Windows Defender has taken action to protect this machine from malware or other potentially unwanted software. For more information please see the following: - -User: -Name: -ID: -Severity: -Category: -Action: -Status: -Signature Version: -Engine Version: -Event ID: 1008 -Symbolic name: - -**MALWAREPROTECTION\_MALWARE\_ACTION\_FAILED** - -Message: - -**The antimalware platform attempted to perform an action to protect your system from malware or other potentially unwanted software, but the action failed.** - -Description: - -Windows Defender has encountered an error when taking action on malware or other potentially unwanted software. For more information please see the following: - -User: -Name: -ID: -Severity: -Category: -Path: -Action: -Error Code: -Error Description: -Status: -Signature Version: -Engine Version: -Event ID: 1009 -Symbolic name: - -**MALWAREPROTECTION\_QUARANTINE\_RESTORE** - -Message: - -**The antimalware platform restored an item from quarantine.** - -Description: - -Windows Defender has restored an item from quarantine. For more information please see the following: - -Name: -ID: -Severity: -Category: -Path: -User: -Signature Version: -Engine Version: -Event ID: 1010 -Symbolic name: - -**MALWAREPROTECTION\_QUARANTINE\_RESTORE\_FAILED** - -Message: - -**The antimalware platform could not restore an item from quarantine.** - -Description: - -Windows Defender has encountered an error trying to restore an item from quarantine. For more information please see the following: - -Name: -ID: -Severity: -Category: -Path: -User: -Error Code: -Error Description: -Signature Version: -Engine Version: -Event ID: 1011 -Symbolic name: - -**MALWAREPROTECTION\_QUARANTINE\_DELETE** - -Message: - -**The antimalware platform deleted an item from quarantine.** - -Description: - -Windows Defender has deleted an item from quarantine. For more information please see the following: - -Name: -ID: -Severity: -Category: -Path: -User: -Signature Version: -Engine Version: -Event ID: 1012 -Symbolic name: - -**MALWAREPROTECTION\_QUARANTINE\_DELETE\_FAILED** - -Message: - -**The antimalware platform could not delete an item from quarantine.** - -Description: - -Windows Defender has encountered an error trying to delete an item from quarantine. For more information please see the following: - -Name: -ID: -Severity: -Category: -Path: -User: -Error Code: -Error Description: -Signature Version: -Engine Version: -Event ID: 1013 -Symbolic name: - -**MALWAREPROTECTION\_MALWARE\_HISTORY\_DELETE** - -Message: - -**The antimalware platform deleted history of malware and other potentially unwanted software.** - -Description: - -Windows Defender has removed history of malware and other potentially unwanted software. - -Time: -User: -Event ID: 1014 -Symbolic name: - -**MALWAREPROTECTION\_MALWARE\_HISTORY\_DELETE\_FAILED** - -Message: - -The antimalware platform could not delete history of malware and other potentially unwanted software. - -Description: - -Windows Defender has encountered an error trying to remove history of malware and other potentially unwanted software. - -Time: -User: -Error Code: -Error Description: -Event ID: 1015 -Symbolic name: - -**MALWAREPROTECTION\_BEHAVIOR\_DETECTED** - -Message: - -**The antimalware platform detected suspicious behavior.** - -Description: - -Windows Defender has detected a suspicious behavior. For more information please see the following: - -Name: -ID: -Severity: -Category: -Path: -Detection Origin: -Detection Type: -Detection Source: -Status: -User: -Process Name: -Signature ID: -Signature Version: -Engine Version: -Fidelity Label: -Target File Name: -Event ID: 1116 -Symbolic name: - -**MALWAREPROTECTION\_STATE\_MALWARE\_DETECTED** - -Message: - -**The antimalware platform detected malware or other potentially unwanted software.** - -Description: - -Windows Defender has detected malware or other potentially unwanted software. For more information please see the following: - -Name: -ID: -Severity: -Category: -Path: -Detection Origin: -Detection Type: -Detection Source: -User: -Process Name: -Signature Version: -Engine Version: -User action: - -No action is required. Windows Defender can suspend and take routine action on this threat. If you want to remove the threat manually, in the Windows Defender interface, click **Clean Computer**. - -Event ID: 1117 -Symbolic name: - -**MALWAREPROTECTION\_STATE\_MALWARE\_ACTION\_TAKEN** - -Message: - -**The antimalware platform performed an action to protect your system from malware or other potentially unwanted software.** - -Description: - -Windows Defender has taken action to protect this machine from malware or other potentially unwanted software. For more information please see the following: - -Name: -ID: -Severity: -Category: -Path: -Detection Origin: -Detection Type: -Detection Source: -User: -Process Name: -Action: -Action Status: -Error Code: -Error Description: -Signature Version: -Engine Version: -User action: - -No action is necessary. Windows Defender removed or quarantined a threat. - -Event ID: 1118 -Symbolic name: - -**MALWAREPROTECTION\_STATE\_MALWARE\_ACTION\_FAILED** - -Message: - -**The antimalware platform attempted to perform an action to protect your system from malware or other potentially unwanted software, but the action failed.** - -Description: - -Windows Defender has encountered a non-critical error when taking action on malware or other potentially unwanted software. For more information please see the following: - -Name: -ID: -Severity: -Category: -Path: -Detection Origin: -Detection Type: -Detection Source: -User: -Process Name: -Action: -Action Status: -Error Code: -Error Description: -Signature Version: -Engine Version: -User action: - -No action is necessary. Windows Defender failed to complete a task related to the malware remediation. This is not a critical failure. - -Event ID: 1119 -Symbolic name: - -**MALWAREPROTECTION\_STATE\_MALWARE\_ACTION\_CRITICALLY\_FAILED** - -Message: - -**The antimalware platform encountered a critical error when trying to take action on malware or other potentially unwanted software. There are more details in the event message.** - -Description: - -Windows Defender has encountered a critical error when taking action on malware or other potentially unwanted software. For more information please see the following: - -Name: -ID: -Severity: -Category: -Path: -Detection Origin: -Detection Type: -Detection Source: -User: -Process Name: -Action: -Action Status: -Error Code: -Error Description: -Signature Version: -Engine Version: -User action: - -The Windows Defender client encountered this error due to critical issues. The endpoint might not be protected. Review the error description then follow the relevant **User action** steps below. - ---- - - - - + + + + - - - - - + + + - - - + + + + - - - + + + + - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ActionUser action
Event ID: 1000 +

Symbolic name:

+
+

MALWAREPROTECTION_SCAN_STARTED

+

Remove

Update the definitions then verify that the removal was successful.

+

Message:

+
+

An antimalware scan started. +

+

Clean

Update the definitions then verify that the remediation was successful.

+

Description:

+
+

+

+
Scan ID:
+
Scan Type:
+
Scan Parameters:
+
Scan Resources:
+
User:
+
+

+
+

+

+
<ID number of the relevant scan.>
+
<Scan type>, for example:
+
Scan Parameters:
+
Scan Resources:
+
User:
+
+

+

Quarantine

Update the definitions and verify that the user has permission to access the necessary resources.

Event ID: 1001 +

Symbolic name:

+
+

MALWAREPROTECTION_SCAN_COMPLETED

+

Allow

Verify that the user has permission to access the necessary resources.

+

Message:

+
+

An antimalware scan finished.

+
+

Description:

+
+

+

+
Scan ID:
+
Scan Type:
+
Scan Parameters:
+
User:
+
Scan Time:
+
+

+
Event ID: 1002 +

Symbolic name:

+
+

MALWAREPROTECTION_SCAN_CANCELLED +

+
+

Message:

+
+

An antimalware scan was stopped before it finished. +

+
+

Description:

+
+

+

+
Scan ID:
+
Scan Type:
+
Scan Parameters:
+
User:
+
Scan Time:
+
+

+
Event ID: 1003 +

Symbolic name:

+
+

MALWAREPROTECTION_SCAN_PAUSED +

+
+

Message:

+
+

An antimalware scan was paused. +

+
+

Description:

+
+

+

+
Scan ID:
+
Scan Type:
+
Scan Parameters:
+
User:
+
+

+
Event ID: 1004 +

Symbolic name:

+
+

MALWAREPROTECTION_SCAN_RESUMED +

+
+

Message:

+
+

An antimalware scan was resumed. +

+
+

Description:

+
+

+

+
Scan ID:
+
Scan Type:
+
Scan Parameters:
+
User:
+
+

+
Event ID: 1005 +

Symbolic name:

+
+

MALWAREPROTECTION_SCAN_FAILED +

+
+

Message:

+
+

An antimalware scan failed. +

+
+

Description:

+
+

+

+
Scan ID:
+
Scan Type:
+
Scan Parameters:
+
User:
+
Error Code:
+
Error Description:
+
+

+
+

User action:

+
+

The Windows Defender client encountered an error, and the current scan has stopped. The scan might fail due to a client-side issue. This event record includes the scan ID, type of scan (antivirus, antispyware, antimalware), scan parameters, the user that started the scan, the error code, and a description of the error. + +

+

To troubleshoot this event: +

    +
  1. Run the scan again.
  2. +
  3. If it fails in the same way, go to the Microsoft Support site, enter the error number in the Search box to look for the error code.
  4. +
  5. Contact Microsoft Technical Support. +
  6. +
+

+
Event ID: 1006 +

Symbolic name:

+
+

MALWAREPROTECTION_MALWARE_DETECTED +

+
+

Message:

+
+

The antimalware engine found malware or other potentially unwanted software. +

+
+

Description:

+
+

+

For more information please see the following:

+
+
Name:
+
ID:
+
Severity:
+
Category
+
Path:
+
Detection Origin:
+
Detection Type:
+
Detection Source:
+
Status:
+
User:
+
Process Name:
+
Signature Version:
+
Engine Version:
+
+

+
Event ID: 1007 +

Symbolic name:

+
+

MALWAREPROTECTION_MALWARE_ACTION_TAKEN +

+
+

Message:

+
+

The antimalware platform performed an action to protect your system from malware or other potentially unwanted software. +

+
+

Description:

+
+

+

Windows Defender has taken action to protect this machine from malware or other potentially unwanted software. For more information please see the following:

+
+
User:
+
Name:
+
ID:
+
Severity:
+
Category:
+
Action:
+
Status:
+
Signature Version:
+
Engine Version:
+
+

+
Event ID: 1008 +

Symbolic name:

+
+

MALWAREPROTECTION_MALWARE_ACTION_FAILED

+
+

Message:

+
+

The antimalware platform attempted to perform an action to protect your system from malware or other potentially unwanted software, but the action failed.

+
+

Description:

+
+

+

Windows Defender has encountered an error when taking action on malware or other potentially unwanted software. For more information please see the following:

+
+
User:
+
Name:
+
ID:
+
Severity:
+
Category:
+
Path:
+
Action:
+
Error Code:
+
Error Description:
+
Status:
+
Signature Version:
+
Engine Version:
+
+

+
Event ID: 1009 +

Symbolic name:

+
+

MALWAREPROTECTION_QUARANTINE_RESTORE +

+
+

Message:

+
+

The antimalware platform restored an item from quarantine. +

+
+

Description:

+
+

+

Windows Defender has restored an item from quarantine. For more information please see the following:

+
+
Name:
+
ID:
+
Severity:
+
Category:
+
Path:
+
User:
+
Signature Version:
+
Engine Version:
+
+

+
Event ID: 1010 +

Symbolic name:

+
+

MALWAREPROTECTION_QUARANTINE_RESTORE_FAILED +

+
+

Message:

+
+

The antimalware platform could not restore an item from quarantine. +

+
+

Description:

+
+

+

Windows Defender has encountered an error trying to restore an item from quarantine. For more information please see the following:

+
+
Name:
+
ID:
+
Severity:
+
Category:
+
Path:
+
User:
+
Error Code:
+
Error Description:
+
Signature Version:
+
Engine Version:
+
+

+
Event ID: 1011 +

Symbolic name:

+
+

MALWAREPROTECTION_QUARANTINE_DELETE

+
+

Message:

+
+

The antimalware platform deleted an item from quarantine. +

+
+

Description:

+
+

+

Windows Defender has deleted an item from quarantine. +For more information please see the following:

+
+
Name:
+
ID:
+
Severity:
+
Category:
+
Path:
+
User:
+
Signature Version:
+
Engine Version:
+
+

+
Event ID: 1012 +

Symbolic name:

+
+

MALWAREPROTECTION_QUARANTINE_DELETE_FAILED +

+
+

Message:

+
+

The antimalware platform could not delete an item from quarantine.

+
+

Description:

+
+

+

Windows Defender has encountered an error trying to delete an item from quarantine. +For more information please see the following:

+
+
Name:
+
ID:
+
Severity:
+
Category:
+
Path:
+
User:
+
Error Code:
+
Error Description:
+
Signature Version:
+
Engine Version:
+
+

+
Event ID: 1013 +

Symbolic name:

+
+

MALWAREPROTECTION_MALWARE_HISTORY_DELETE +

+
+

Message:

+
+

The antimalware platform deleted history of malware and other potentially unwanted software.

+
+

Description:

+
+

+

Windows Defender has removed history of malware and other potentially unwanted software.

+
+
Time:
+
User:
+
+

+
Event ID: 1014 +

Symbolic name:

+
+

MALWAREPROTECTION_MALWARE_HISTORY_DELETE_FAILED +

+
+

Message:

+
+

The antimalware platform could not delete history of malware and other potentially unwanted software.

+
+

Description:

+
+

+

Windows Defender has encountered an error trying to remove history of malware and other potentially unwanted software.

+
+
Time:
+
User:
+
Error Code:
+
Error Description:
+
+

+
Event ID: 1015 +

Symbolic name:

+
+

MALWAREPROTECTION_BEHAVIOR_DETECTED +

+
+

Message:

+
+

The antimalware platform detected suspicious behavior.

+
+

Description:

+
+

+

Windows Defender has detected a suspicious behavior. +For more information please see the following:

+
+
Name:
+
ID:
+
Severity:
+
Category:
+
Path:
+
Detection Origin:
+
Detection Type:
+
Detection Source:
+
Status:
+
User:
+
Process Name:
+
Signature ID:
+
Signature Version:
+
Engine Version:
+
Fidelity Label:
+
Target File Name:
+
+

+
Event ID: 1116 +

Symbolic name:

+
+

MALWAREPROTECTION_STATE_MALWARE_DETECTED

+
+

Message:

+
+

The antimalware platform detected malware or other potentially unwanted software. +

+
+

Description:

+
+

+

Windows Defender has detected malware or other potentially unwanted software. +For more information please see the following:

+
+
Name:
+
ID:
+
Severity:
+
Category:
+
Path:
+
Detection Origin:
+
Detection Type:
+
Detection Source:
+
User:
+
Process Name:
+
Signature Version:
+
Engine Version:
+
+

+
+

User action:

+
+

No action is required. Windows Defender can suspend and take routine action on this threat. If you want to remove the threat manually, in the Windows Defender interface, click Clean Computer.

+
Event ID: 1117 +

Symbolic name:

+
+

MALWAREPROTECTION_STATE_MALWARE_ACTION_TAKEN +

+
+

Message:

+
+

The antimalware platform performed an action to protect your system from malware or other potentially unwanted software. +

+
+

Description:

+
+

+

Windows Defender has taken action to protect this machine from malware or other potentially unwanted software. +For more information please see the following:

+
+
Name:
+
ID:
+
Severity:
+
Category:
+
Path:
+
Detection Origin:
+
Detection Type:
+
Detection Source:
+
User:
+
Process Name:
+
Action:
+
Action Status:
+
Error Code:
+
Error Description:
+
Signature Version:
+
Engine Version:
+
+

+
+

User action:

+
+

No action is necessary. Windows Defender removed or quarantined a threat.

+
Event ID: 1118 +

Symbolic name:

+
+

MALWAREPROTECTION_STATE_MALWARE_ACTION_FAILED

+
+

Message:

+
+

The antimalware platform attempted to perform an action to protect your system from malware or other potentially unwanted software, but the action failed. +

+
+

Description:

+
+

+

Windows Defender has encountered a non-critical error when taking action on malware or other potentially unwanted software. +For more information please see the following:

+
+
Name:
+
ID:
+
Severity:
+
Category:
+
Path:
+
Detection Origin:
+
Detection Type:
+
Detection Source:
+
User:
+
Process Name:
+
Action:
+
Action Status:
+
Error Code:
+
Error Description:
+
Signature Version:
+
Engine Version:
+
+

+
+

User action:

+
+

No action is necessary. Windows Defender failed to complete a task related to the malware remediation. This is not a critical failure.

+
Event ID: 1119 +

Symbolic name:

+
+

MALWAREPROTECTION_STATE_MALWARE_ACTION_CRITICALLY_FAILED +

+
+

Message:

+
+

The antimalware platform encountered a critical error when trying to take action on malware or other potentially unwanted software. There are more details in the event message.

+
+

Description:

+
+

+

Windows Defender has encountered a critical error when taking action on malware or other potentially unwanted software. +For more information please see the following:

+
+
Name:
+
ID:
+
Severity:
+
Category:
+
Path:
+
Detection Origin:
+
Detection Type:
+
Detection Source:
+
User:
+
Process Name:
+
Action:
+
Action Status:
+
Error Code:
+
Error Description:
+
Signature Version:
+
Engine Version:
+
+

+
+

User action:

+
+

The Windows Defender client encountered this error due to critical issues. The endpoint might not be protected. Review the error description then follow the relevant User action steps below.

+ + + + + + + + + + + + + + + + + + + + + +
ActionUser action
+

Remove

+
+

Update the definitions then verify that the removal was successful.

+
+

Clean

+
+

Update the definitions then verify that the remediation was successful.

+
+

Quarantine

+
+

Update the definitions and verify that the user has permission to access the necessary resources.

+
+

Allow

+
+

Verify that the user has permission to access the necessary resources.

+
+

 

+

If this event persists:

    +
  1. Run the scan again.
  2. +
  3. If it fails in the same way, go to the Microsoft Support site, enter the error number in the Search box to look for the error code.
  4. +
  5. Contact Microsoft Technical Support. +
  6. +
+

+
Event ID: 1120 +

Symbolic name:

+
+

MALWAREPROTECTION_THREAT_HASH

+
+

Message:

+
+

Windows Defender has deduced the hashes for a threat resource.

+
+

Description:

+
+

+

Windows Defender client is up and running in a healthy state.

+
+
Current Platform Version:
+
Threat Resource Path:
+
Hashes:
+
+

+
+
Note  This event will only be logged if the following policy is set: ThreatFileHashLogging unsigned.
+
 
+
Event ID: 1150 +

Symbolic name:

+
+

MALWAREPROTECTION_SERVICE_HEALTHY

+
+

Message:

+
+

If your antimalware platform reports status to a monitoring platform, this event indicates that the antimalware platform is running and in a healthy state. +

+
+

Description:

+
+

+

Windows Defender client is up and running in a healthy state.

+
+
Platform Version:
+
Signature Version:
+
Engine Version:
+
+

+
+

User action:

+
+

No action is necessary. The Windows Defenderclient is in a healthy state. This event is reported on an hourly basis.

+
Event ID: 2000 +

Symbolic name:

+
+

MALWAREPROTECTION_SIGNATURE_UPDATED +

+
+

Message:

+
+

The antimalware definitions updated successfully. +

+
+

Description:

+
+

+

Windows Defender signature version has been updated.

+
+
Current Signature Version:
+
Previous Signature Version:
+
Signature Type:
+
Update Type:
+
User:
+
Current Engine Version:
+
Previous Engine Version:
+
+

+
+

User action:

+
+

No action is necessary. The Windows Defender client is in a healthy state. This event is reported when signatures are successfully updated.

+
Event ID: 2001 +

Symbolic name:

+
+

MALWAREPROTECTION_SIGNATURE_UPDATE_FAILED

+
+

Message:

+
+

The antimalware definition update failed. +

+
+

Description:

+
+

+

Windows Defender has encountered an error trying to update signatures.

+
+
New Signature Version:
+
Previous Signature Version:
+
Update Source:
+
Update Stage:
+
Source Path:
+
Signature Type:
+
Update Type:
+
User:
+
Current Engine Version:
+
Previous Engine Version:
+
Error Code:
+
Error Description:
+
+

+
+

User action:

+
+

This error occurs when there is a problem updating definitions.

+

To troubleshoot this event: +

    +
  1. Update the definitions. Either:
      +
    1. Click the Update definitions button on the Update tab in Windows Defender. Update definitions in Windows Defender

      Or,

      +
    2. +
    3. Download the latest definitions from the Microsoft Malware Protection Center. + +

      Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.

      +
    4. +
    +
  2. +
  3. Review the entries in the %Windir%\WindowsUpdate.log file for more information about this error.
  4. +
  5. Contact Microsoft Technical Support. +
  6. +
+

+
Event ID: 2002 +

Symbolic name:

+
+

MALWAREPROTECTION_ENGINE_UPDATED

+
+

Message:

+
+

The antimalware engine updated successfully. +

+
+

Description:

+
+

+

Windows Defender engine version has been updated.

+
+
Current Engine Version:
+
Previous Engine Version:
+
Engine Type:
+
User:
+
+

+
+

User action:

+
+

No action is necessary. The Windows Defender client is in a healthy state. This event is reported when the antimalware engine is successfully updated.

+
Event ID: 2003 +

Symbolic name:

+
+

MALWAREPROTECTION_ENGINE_UPDATE_FAILED

+
+

Message:

+
+

The antimalware engine update failed. +

+
+

Description:

+
+

+

Windows Defender has encountered an error trying to update the engine.

+
+
New Engine Version:
+
Previous Engine Version:
+
Engine Type:
+
User:
+
Error Code:
+
Error Description:
+
+

+
+

User action:

+
+

The Windows Defender client update failed. This event occurs when the client fails to update itself. This event is usually due to an interruption in network connectivity during an update.

+

To troubleshoot this event: +

    +
  1. Update the definitions. Either:
      +
    1. Click the Update definitions button on the Update tab in Windows Defender. Update definitions in Windows Defender

      Or,

      +
    2. +
    3. Download the latest definitions from the Microsoft Malware Protection Center. + +

      Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.

      +
    4. +
    +
  2. +
  3. Contact Microsoft Technical Support. +
  4. +
+

+
Event ID: 2004 +

Symbolic name:

+
+

MALWAREPROTECTION_SIGNATURE_REVERSION

+
+

Message:

+
+

There was a problem loading antimalware definitions. The antimalware engine will attempt to load the last-known good set of definitions.

+
+

Description:

+
+

+

Windows Defender has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures.

+
+
Signatures Attempted:
+
Error Code:
+
Error Description:
+
Signature Version:
+
Engine Version:
+
+

+
+

User action:

+
+

The Windows Defender client attempted to download and install the latest definitions file and failed. This error can occur when the client encounters an error while trying to load the definitions, or if the file is corrupt. Windows Defender will attempt to revert back to a known-good set of definitions.

+

To troubleshoot this event: +

    +
  1. Restart the computer and try again.
  2. +
  3. Download the latest definitions from the Microsoft Malware Protection Center. + +

    Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.

    +
  4. +
  5. Contact Microsoft Technical Support. +
  6. +
+

+
Event ID: 2005 +

Symbolic name:

+
+

MALWAREPROTECTION_ENGINE_UPDATE_PLATFORMOUTOFDATE

+
+

Message:

+
+

The antimalware engine failed to load because the antimalware platform is out of date. The antimalware platform will load the last-known good antimalware engine and attempt to update.

+
+

Description:

+
+

+

Windows Defender could not load antimalware engine because current platform version is not supported. Windows Defender will revert back to the last known-good engine and a platform update will be attempted.

+
+
Current Platform Version:
+
+

+
Event ID: 2006 +

Symbolic name:

+
+

MALWAREPROTECTION_PLATFORM_UPDATE_FAILED +

+
+

Message:

+
+

The platform update failed. +

+
+

Description:

+
+

+

Windows Defender has encountered an error trying to update the platform.

+
+
Current Platform Version:
+
Error Code:
+
Error Description:
+
+

+
Event ID: 2007 +

Symbolic name:

+
+

MALWAREPROTECTION_PLATFORM_ALMOSTOUTOFDATE

+
+

Message:

+
+

The platform will soon be out of date. Download the latest platform to maintain up-to-date protection.

+
+

Description:

+
+

+

Windows Defender will soon require a newer platform version to support future versions of the antimalware engine. Download the latest Windows Defender platform to maintain the best level of protection available.

+
+
Current Platform Version:
+
+

+
Event ID: 2010 +

Symbolic name:

+
+

MALWAREPROTECTION_SIGNATURE_FASTPATH_UPDATED +

+
+

Message:

+
+

The antimalware engine used the Dynamic Signature Service to get additional definitions. +

+
+

Description:

+
+

+

Windows Defender used Dynamic Signature Service to retrieve additional signatures to help protect your machine.

+
+
Current Signature Version:
+
Signature Type:
+
Current Engine Version:
+
Dynamic Signature Type:
+
Persistence Path:
+
Dynamic Signature Version:
+
Dynamic Signature Compilation Timestamp:
+
Persistence Limit Type:
+
Persistence Limit:
+
+

+
Event ID: 2011 +

Symbolic name:

+
+

MALWAREPROTECTION_SIGNATURE_FASTPATH_DELETED +

+
+

Message:

+
+

The Dynamic Signature Service deleted the out-of-date dynamic definitions. +

+
+

Description:

+
+

+

Windows Defender used Dynamic Signature Service to discard obsolete signatures.

+
+
Current Signature Version:
+
Signature Type:
+
Current Engine Version:
+
Dynamic Signature Type:
+
Persistence Path:
+
Dynamic Signature Version:
+
Dynamic Signature Compilation Timestamp:
+
Removal Reason:
+
Persistence Limit Type:
+
Persistence Limit:
+
+

+
+

User action:

+
+

No action is necessary. The Windows Defender client is in a healthy state. This event is reported when the Dynamic Signature Service successfully deletes out-of-date dynamic definitions.

+
Event ID: 2012 +

Symbolic name:

+
+

MALWAREPROTECTION_SIGNATURE_FASTPATH_UPDATE_FAILED +

+
+

Message:

+
+

The antimalware engine encountered an error when trying to use the Dynamic Signature Service. +

+
+

Description:

+
+

+

Windows Defender has encountered an error trying to use Dynamic Signature Service.

+
+
Current Signature Version:
+
Signature Type:
+
Current Engine Version:
+
Error Code:
+
Error Description:
+
Dynamic Signature Type:
+
Persistence Path:
+
Dynamic Signature Version:
+
Dynamic Signature Compilation Timestamp:
+
Persistence Limit Type:
+
Persistence Limit:
+
+

+
+

User action:

+
+

Check your Internet connectivity settings.

+
Event ID: 2013 +

Symbolic name:

+
+

MALWAREPROTECTION_SIGNATURE_FASTPATH_DELETED_ALL +

+
+

Message:

+
+

The Dynamic Signature Service deleted all dynamic definitions. +

+
+

Description:

+
+

+

Windows Defender discarded all Dynamic Signature Service signatures.

+
+
Current Signature Version:
+
+

+
Event ID: 2020 +

Symbolic name:

+
+

MALWAREPROTECTION_CLOUD_CLEAN_RESTORE_FILE_DOWNLOADED +

+
+

Message:

+
+

The antimalware engine downloaded a clean file. +

+
+

Description:

+
+

+

Windows Defender downloaded a clean file.

+
+
Filename:
+
Current Signature Version:
+
Current Engine Version:
+
+

+
Event ID: 2021 +

Symbolic name:

+
+

MALWAREPROTECTION_CLOUD_CLEAN_RESTORE_FILE_DOWNLOAD_FAILED

+
+

Message:

+
+

The antimalware engine failed to download a clean file. +

+
+

Description:

+
+

+

Windows Defender has encountered an error trying to download a clean file.

+
+
Filename:
+
Current Signature Version:
+
Current Engine Version:
+
Error Code:
+
Error Description:
+
+

+
+

User action:

+
+

Check your Internet connectivity settings. +

+

The Windows Defender client encountered an error when using the Dynamic Signature Service to download the latest definitions to a specific threat. This error is likely caused by a network connectivity issue. +

+
Event ID: 2030 +

Symbolic name:

+
+

MALWAREPROTECTION_OFFLINE_SCAN_INSTALLED

+
+

Message:

+
+

The antimalware engine was downloaded and is configured to run offline on the next system restart.

+
+

Description:

+
+

Windows Defender downloaded and configured Windows Defender Offline to run on the next reboot.

+
Event ID: 2031 +

Symbolic name:

+
+

MALWAREPROTECTION_OFFLINE_SCAN_INSTALL_FAILED +

+
+

Message:

+
+

The antimalware engine was unable to download and configure an offline scan.

+
+

Description:

+
+

+

Windows Defender has encountered an error trying to download and configure Windows Defender Offline.

+
+
Error Code:
+
Error Description:
+
+

+
Event ID: 2040 +

Symbolic name:

+
+

MALWAREPROTECTION_OS_EXPIRING +

+
+

Message:

+
+

Antimalware support for this operating system version will soon end. +

+
+

Description:

+
+

The support for your operating system will expire shortly. Running Windows Defender on an out of support operating system is not an adequate solution to protect against threats.

+
Event ID: 2041 +

Symbolic name:

+
+

MALWAREPROTECTION_OS_EOL +

+
+

Message:

+
+

Antimalware support for this operating system has ended. You must upgrade the operating system for continued support. +

+
+

Description:

+
+

The support for your operating system has expired. Running Windows Defender on an out of support operating system is not an adequate solution to protect against threats.

+
Event ID: 2042 +

Symbolic name:

+
+

MALWAREPROTECTION_PROTECTION_EOL +

+
+

Message:

+
+

The antimalware engine no longer supports this operating system, and is no longer protecting your system from malware. +

+
+

Description:

+
+

The support for your operating system has expired. Windows Defender is no longer supported on your operating system, has stopped functioning, and is not protecting against malware threats.

+
Event ID: 3002 +

Symbolic name:

+
+

MALWAREPROTECTION_RTP_FEATURE_FAILURE +

+
+

Message:

+
+

Real-time protection encountered an error and failed.

+
+

Description:

+
+

+

Windows Defender Real-Time Protection feature has encountered an error and failed.

+
+
Feature:
+
Error Code:
+
Error Description:
+
Reason:
+
+

+
+

User action:

+
+

You should restart the system then run a full scan because it’s possible the system was not protected for some time. +

+

The Windows Defender client’s real-time protection feature encountered an error because one of the services failed to start. +

+

If it is followed by a 3007 event ID, the failure was temporary and the antimalware client recovered from the failure. +

+
Event ID: 3007 +

Symbolic name:

+
+

MALWAREPROTECTION_RTP_FEATURE_RECOVERED

+
+

Message:

+
+

Real-time protection recovered from a failure. We recommend running a full system scan when you see this error. +

+
+

Description:

+
+

+

Windows Defender Real-time Protection has restarted a feature. It is recommended that you run a full system scan to detect any items that may have been missed while this agent was down.

+
+
Feature:
+
Reason:
+
+

+
+

User action:

+
+

The real-time protection feature has restarted. If this event happens again, contact Microsoft Technical Support.

+
Event ID: 5000 +

Symbolic name:

+
+

MALWAREPROTECTION_RTP_ENABLED +

+
+

Message:

+
+

Real-time protection is enabled. +

+
+

Description:

+
+

Windows Defender Real-time Protection scanning for malware and other potentially unwanted software was enabled.

+
Event ID: 5001 +

Symbolic name:

+
+

MALWAREPROTECTION_RTP_DISABLED

+
+

Message:

+
+

Real-time protection is disabled. +

+
+

Description:

+
+

Windows Defender Real-time Protection scanning for malware and other potentially unwanted software was disabled.

+
Event ID: 5004 +

Symbolic name:

+
+

MALWAREPROTECTION_RTP_FEATURE_CONFIGURED +

+
+

Message:

+
+

The real-time protection configuration changed. +

+
+

Description:

+
+

+

Windows Defender Real-time Protection feature configuration has changed.

+
+
Feature:
+
Configuration:
+
+

+
Event ID: 5007 +

Symbolic name:

+
+

MALWAREPROTECTION_CONFIG_CHANGED +

+
+

Message:

+
+

The antimalware platform configuration changed.

+
+

Description:

+
+

+

Windows Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.

+
+
Old value:
+
New value:
+
+

+
Event ID: 5008 +

Symbolic name:

+
+

MALWAREPROTECTION_ENGINE_FAILURE

+
+

Message:

+
+

The antimalware engine encountered an error and failed.

+
+

Description:

+
+

+

Windows Defender engine has been terminated due to an unexpected error.

+
+
Failure Type:
+
Exception Code:
+
Resource:
+
+

+
+

User action:

+
+

To troubleshoot this event:

    +
  1. Try to restart the service.
      +
    • For antimalware, antivirus and spyware, at an elevated command prompt, type net stop msmpsvc, and then type net start msmpsvc to restart the antimalware engine.
    • +
    • For the Network Inspection System, at an elevated command prompt, type net start nissrv, and then type net start nissrv to restart the Network Inspection System engine by using the NiSSRV.exe file. + + + +
    • +
    +
  2. +
  3. If it fails in the same way, look up the error code by accessing the Microsoft Support Site and entering the error number in the Search box, and contact Microsoft Technical Support.
  4. +
+

+
+

User action:

+
+

The Windows Defender client engine stopped due to an unexpected error.

+

To troubleshoot this event: +

    +
  1. Run the scan again.
  2. +
  3. If it fails in the same way, go to the Microsoft Support site, enter the error number in the Search box to look for the error code.
  4. +
  5. Contact Microsoft Technical Support. +
  6. +
+

+
Event ID: 5009 +

Symbolic name:

+
+

MALWAREPROTECTION_ANTISPYWARE_ENABLED +

+
+

Message:

+
+

Scanning for malware and other potentially unwanted software is enabled. +

+
+

Description:

+
+

Windows Defender scanning for malware and other potentially unwanted software has been enabled.

+
Event ID: 5010 +

Symbolic name:

+
+

MALWAREPROTECTION_ANTISPYWARE_DISABLED +

+
+

Message:

+
+

Scanning for malware and other potentially unwanted software is disabled.

+
+

Description:

+
+

Windows Defender scanning for malware and other potentially unwanted software is disabled.

+
Event ID: 5011 +

Symbolic name:

+
+

MALWAREPROTECTION_ANTIVIRUS_ENABLED

+
+

Message:

+
+

Scanning for viruses is enabled.

+
+

Description:

+
+

Windows Defender scanning for viruses has been enabled.

+
Event ID: 5012 +

Symbolic name:

+
+

MALWAREPROTECTION_ANTIVIRUS_DISABLED +

+
+

Message:

+
+

Scanning for viruses is disabled. +

+
+

Description:

+
+

Windows Defender scanning for viruses is disabled.

+
Event ID: 5100 +

Symbolic name:

+
+

MALWAREPROTECTION_EXPIRATION_WARNING_STATE +

+
+

Message:

+
+

The antimalware platform will expire soon. +

+
+

Description:

+
+

+

Windows Defender has entered a grace period and will soon expire. After expiration, this program will disable protection against viruses, spyware, and other potentially unwanted software.

+
+
Expiration Reason:
+
Expiration Date:
+
+

+
Event ID: 5101 +

Symbolic name:

+
+

MALWAREPROTECTION_DISABLED_EXPIRED_STATE +

+
+

Message:

+
+

The antimalware platform is expired. +

+
+

Description::

+
+

+

Windows Defender grace period has expired. Protection against viruses, spyware, and other potentially unwanted software is disabled.

+
+
Expiration Reason:
+
Expiration Date:
+
Error Code:
+
Error Description:
+
+

+
+

 

+

Windows Defender client error codes

+

If Windows Defender experiences any issues it will usually give you an error code to help you troubleshoot the issue. + +Most often an error means there was a problem installing an update. +

+

This section provides the following information about Windows Defender client errors.

+

+

Use the information in these tables to help troubleshoot Windows Defender error codes.

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
External error codes
Error codeMessage displayedPossible reason for errorWhat to do now
+

xxxx

+
+

xxxx

+
+

xxxx

+
+

xxxx

+
+

xxxx

+
+

xxxx

+
+

xxxx

+
+

xxxx

+
+

xxxx

+
+

xxxx

+
+

xxxx

+
+

xxxx

+
+

xxxx

+
+

xxxx

+
+

xxxx

+
+

xxxx

+
+

xxxx

+
+

xxxx

+
+

xxxx

+
+

xxxx

+
+

xxxx

+
+

xxxx

+
+

xxxx

+
+

xxxx

+
+

xxxx

+
+

xxxx

+
+

xxxx

+
+

 

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + -
Internal error codes
Error codeMessage displayedPossible reason for errorWhat to do now
+

0x80501000

+
+

ERROR_MP_UI_CONSOLIDATION_BASE

+
+

This is an internal error. The cause is not clearly defined.

+
+

+

    +
  1. Update the definitions. Either:
      +
    1. Click the Update definitions button on the Update tab in Windows Defender. Update definitions in Windows Defender

      Or,

      +
    2. +
    3. Download the latest definitions from the Microsoft Malware Protection Center. + +

      Note: The size of the definitions file downloaded from the Microsoft Malware Protection Center can exceed 60 MB and should not be used as a long-term solution for updating definitions.

      +
    4. +
    +
  2. +
  3. Run a full scan. +
  4. +
  5. Restart the device and try again.
  6. +
+

+
+

0x80501001

+
+

ERROR_MP_ACTIONS_FAILED

+
+

0x80501002

+
+

ERROR_MP_NOENGINE

+
+

0x80501003

+
+

ERROR_MP_ACTIVE_THREATS

+
+

0x805011011

+
+

MP_ERROR_CODE_LUA_CANCELLED

+
+

0x80501101

+
+

ERROR_LUA_CANCELLATION

+
+

0x80501102

+
+

MP_ERROR_CODE_ALREADY_SHUTDOWN

+
+

0x80501103

+
+

MP_ERROR_CODE_RDEVICE_S_ASYNC_CALL_PENDING

+
+

0x80501104

+
+

MP_ERROR_CODE_CANCELLED

+
+

0x80501105

+
+

MP_ERROR_CODE_NO_TARGETOS

+
+

0x80501106

+
+

MP_ERROR_CODE_BAD_REGEXP

+
+

0x80501107

+
+

MP_ERROR_TEST_INDUCED_ERROR

+
+

0x80501108

+
+

MP_ERROR_SIG_BACKUP_DISABLED

+
+

0x80508001

+
+

ERR_MP_BAD_INIT_MODULES

+
+

0x80508002

+
+

ERR_MP_BAD_DATABASE

+
+

0x80508004

+
+

ERR_MP_BAD_UFS

+
+

0x8050800C

+
+

ERR_MP_BAD_INPUT_DATA

+
+

0x8050800D

+
+

ERR_MP_BAD_GLOBAL_STORAGE

+
+

0x8050800E

+
+

ERR_MP_OBSOLETE

+
+

0x8050800F

+
+

ERR_MP_NOT_SUPPORTED

+
+

0x8050800F +0x80508010 +

+
+

ERR_MP_NO_MORE_ITEMS

+
+

0x80508011

+
+

ERR_MP_DUPLICATE_SCANID

+
+

0x80508012

+
+

ERR_MP_BAD_SCANID

+
+

0x80508013

+
+

ERR_MP_BAD_USERDB_VERSION

+
+

0x80508014

+
+

ERR_MP_RESTORE_FAILED

+
+

0x80508016

+
+

ERR_MP_BAD_ACTION

+
+

0x80508019

+
+

ERR_MP_NOT_FOUND

+
+

0x80509001

+
+

ERR_RELO_BAD_EHANDLE

+
+

0x80509003

+
+

ERR_RELO_KERNEL_NOT_LOADED

+
+

0x8050A001

+
+

ERR_MP_BADDB_OPEN

+
+

0x8050A002

+
+

ERR_MP_BADDB_HEADER

+
+

0x8050A003

+
+

ERR_MP_BADDB_OLDENGINE

+
+

0x8050A004

+
+

ERR_MP_BADDB_CONTENT

+
+

0x8050A005

+
+

ERR_MP_BADDB_NOTSIGNED

+
- -  - -If this event persists: - -1. Run the scan again. -2. If it fails in the same way, go to the [Microsoft Support site](http://go.microsoft.com/fwlink/?LinkId=215163), enter the error number in the **Search** box to look for the error code. -3. Contact [Microsoft Technical Support](http://go.microsoft.com/fwlink/?LinkId=215491). - -Event ID: 1120 -Symbolic name: - -**MALWAREPROTECTION\_THREAT\_HASH** - -Message: - -**Windows Defender has deduced the hashes for a threat resource.** - -Description: - -Windows Defender client is up and running in a healthy state. - -Current Platform Version: -Threat Resource Path: -Hashes: -**Note**  This event will only be logged if the following policy is set: **ThreatFileHashLogging unsigned**. - -  - -Event ID: 1150 -Symbolic name: - -**MALWAREPROTECTION\_SERVICE\_HEALTHY** - -Message: - -**If your antimalware platform reports status to a monitoring platform, this event indicates that the antimalware platform is running and in a healthy state.** - -Description: - -Windows Defender client is up and running in a healthy state. - -Platform Version: -Signature Version: -Engine Version: -User action: - -No action is necessary. The Windows Defenderclient is in a healthy state. This event is reported on an hourly basis. - -Event ID: 2000 -Symbolic name: - -**MALWAREPROTECTION\_SIGNATURE\_UPDATED** - -Message: - -**The antimalware definitions updated successfully.** - -Description: - -Windows Defender signature version has been updated. - -Current Signature Version: -Previous Signature Version: -Signature Type: -Update Type: -User: -Current Engine Version: -Previous Engine Version: -User action: - -No action is necessary. The Windows Defender client is in a healthy state. This event is reported when signatures are successfully updated. - -Event ID: 2001 -Symbolic name: - -**MALWAREPROTECTION\_SIGNATURE\_UPDATE\_FAILED** - -Message: - -**The antimalware definition update failed.** - -Description: - -Windows Defender has encountered an error trying to update signatures. - -New Signature Version: -Previous Signature Version: -Update Source: -Update Stage: -Source Path: -Signature Type: -Update Type: -User: -Current Engine Version: -Previous Engine Version: -Error Code: -Error Description: -User action: - -This error occurs when there is a problem updating definitions. - -To troubleshoot this event: - -1. Update the definitions. Either: - 1. Click the **Update definitions** button on the **Update** tab in Windows Defender. ![update definitions in windows defender](images/defender-updatedefs.png) - - Or, - - 2. Download the latest definitions from the [Microsoft Malware Protection Center](http://go.microsoft.com/fwlink/?LinkID=200965). - - Note: The size of the definitions file downloaded from the [Microsoft Malware Protection Center](http://go.microsoft.com/fwlink/?LinkID=200965) can exceed 60 MB and should not be used as a long-term solution for updating definitions. - -2. Review the entries in the %Windir%\\WindowsUpdate.log file for more information about this error. -3. Contact [Microsoft Technical Support](http://go.microsoft.com/fwlink/?LinkId=215491). - -Event ID: 2002 -Symbolic name: - -**MALWAREPROTECTION\_ENGINE\_UPDATED** - -Message: - -**The antimalware engine updated successfully.** - -Description: - -Windows Defender engine version has been updated. - -Current Engine Version: -Previous Engine Version: -Engine Type: -User: -User action: - -No action is necessary. The Windows Defender client is in a healthy state. This event is reported when the antimalware engine is successfully updated. - -Event ID: 2003 -Symbolic name: - -**MALWAREPROTECTION\_ENGINE\_UPDATE\_FAILED** - -Message: - -**The antimalware engine update failed.** - -Description: - -Windows Defender has encountered an error trying to update the engine. - -New Engine Version: -Previous Engine Version: -Engine Type: -User: -Error Code: -Error Description: -User action: - -The Windows Defender client update failed. This event occurs when the client fails to update itself. This event is usually due to an interruption in network connectivity during an update. - -To troubleshoot this event: - -1. Update the definitions. Either: - 1. Click the **Update definitions** button on the **Update** tab in Windows Defender. ![update definitions in windows defender](images/defender-updatedefs.png) - - Or, - - 2. Download the latest definitions from the [Microsoft Malware Protection Center](http://go.microsoft.com/fwlink/?LinkID=200965). - - Note: The size of the definitions file downloaded from the [Microsoft Malware Protection Center](http://go.microsoft.com/fwlink/?LinkID=200965) can exceed 60 MB and should not be used as a long-term solution for updating definitions. - -2. Contact [Microsoft Technical Support](http://go.microsoft.com/fwlink/?LinkId=215491). - -Event ID: 2004 -Symbolic name: - -**MALWAREPROTECTION\_SIGNATURE\_REVERSION** - -Message: - -**There was a problem loading antimalware definitions. The antimalware engine will attempt to load the last-known good set of definitions.** - -Description: - -Windows Defender has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. - -Signatures Attempted: -Error Code: -Error Description: -Signature Version: -Engine Version: -User action: - -The Windows Defender client attempted to download and install the latest definitions file and failed. This error can occur when the client encounters an error while trying to load the definitions, or if the file is corrupt. Windows Defender will attempt to revert back to a known-good set of definitions. - -To troubleshoot this event: - -1. Restart the computer and try again. -2. Download the latest definitions from the [Microsoft Malware Protection Center](http://go.microsoft.com/fwlink/?LinkID=200965). - - Note: The size of the definitions file downloaded from the [Microsoft Malware Protection Center](http://go.microsoft.com/fwlink/?LinkID=200965) can exceed 60 MB and should not be used as a long-term solution for updating definitions. - -3. Contact [Microsoft Technical Support](http://go.microsoft.com/fwlink/?LinkId=215491). - -Event ID: 2005 -Symbolic name: - -**MALWAREPROTECTION\_ENGINE\_UPDATE\_PLATFORMOUTOFDATE** - -Message: - -**The antimalware engine failed to load because the antimalware platform is out of date. The antimalware platform will load the last-known good antimalware engine and attempt to update.** - -Description: - -Windows Defender could not load antimalware engine because current platform version is not supported. Windows Defender will revert back to the last known-good engine and a platform update will be attempted. - -Current Platform Version: -Event ID: 2006 -Symbolic name: - -**MALWAREPROTECTION\_PLATFORM\_UPDATE\_FAILED** - -Message: - -**The platform update failed.** - -Description: - -Windows Defender has encountered an error trying to update the platform. - -Current Platform Version: -Error Code: -Error Description: -Event ID: 2007 -Symbolic name: - -**MALWAREPROTECTION\_PLATFORM\_ALMOSTOUTOFDATE** - -Message: - -**The platform will soon be out of date. Download the latest platform to maintain up-to-date protection.** - -Description: - -Windows Defender will soon require a newer platform version to support future versions of the antimalware engine. Download the latest Windows Defender platform to maintain the best level of protection available. - -Current Platform Version: -Event ID: 2010 -Symbolic name: - -**MALWAREPROTECTION\_SIGNATURE\_FASTPATH\_UPDATED** - -Message: - -**The antimalware engine used the Dynamic Signature Service to get additional definitions.** - -Description: - -Windows Defender used *Dynamic Signature Service* to retrieve additional signatures to help protect your machine. - -Current Signature Version: -Signature Type: -Current Engine Version: -Dynamic Signature Type: -Persistence Path: -Dynamic Signature Version: -Dynamic Signature Compilation Timestamp: -Persistence Limit Type: -Persistence Limit: -Event ID: 2011 -Symbolic name: - -**MALWAREPROTECTION\_SIGNATURE\_FASTPATH\_DELETED** - -Message: - -**The Dynamic Signature Service deleted the out-of-date dynamic definitions.** - -Description: - -Windows Defender used *Dynamic Signature Service* to discard obsolete signatures. - -Current Signature Version: -Signature Type: -Current Engine Version: -Dynamic Signature Type: -Persistence Path: -Dynamic Signature Version: -Dynamic Signature Compilation Timestamp: -Removal Reason: -Persistence Limit Type: -Persistence Limit: -User action: - -No action is necessary. The Windows Defender client is in a healthy state. This event is reported when the Dynamic Signature Service successfully deletes out-of-date dynamic definitions. - -Event ID: 2012 -Symbolic name: - -**MALWAREPROTECTION\_SIGNATURE\_FASTPATH\_UPDATE\_FAILED** - -Message: - -**The antimalware engine encountered an error when trying to use the Dynamic Signature Service.** - -Description: - -Windows Defender has encountered an error trying to use *Dynamic Signature Service*. - -Current Signature Version: -Signature Type: -Current Engine Version: -Error Code: -Error Description: -Dynamic Signature Type: -Persistence Path: -Dynamic Signature Version: -Dynamic Signature Compilation Timestamp: -Persistence Limit Type: -Persistence Limit: -User action: - -Check your Internet connectivity settings. - -Event ID: 2013 -Symbolic name: - -**MALWAREPROTECTION\_SIGNATURE\_FASTPATH\_DELETED\_ALL** - -Message: - -**The Dynamic Signature Service deleted all dynamic definitions.** - -Description: - -Windows Defender discarded all *Dynamic Signature Service* signatures. - -Current Signature Version: -Event ID: 2020 -Symbolic name: - -**MALWAREPROTECTION\_CLOUD\_CLEAN\_RESTORE\_FILE\_DOWNLOADED** - -Message: - -**The antimalware engine downloaded a clean file.** - -Description: - -Windows Defender downloaded a clean file. - -Filename: -Current Signature Version: -Current Engine Version: -Event ID: 2021 -Symbolic name: - -**MALWAREPROTECTION\_CLOUD\_CLEAN\_RESTORE\_FILE\_DOWNLOAD\_FAILED** - -Message: - -**The antimalware engine failed to download a clean file.** - -Description: - -Windows Defender has encountered an error trying to download a clean file. - -Filename: -Current Signature Version: -Current Engine Version: -Error Code: -Error Description: -User action: - -Check your Internet connectivity settings. - -The Windows Defender client encountered an error when using the Dynamic Signature Service to download the latest definitions to a specific threat. This error is likely caused by a network connectivity issue. - -Event ID: 2030 -Symbolic name: - -**MALWAREPROTECTION\_OFFLINE\_SCAN\_INSTALLED** - -Message: - -**The antimalware engine was downloaded and is configured to run offline on the next system restart.** - -Description: - -Windows Defender downloaded and configured Windows Defender Offline to run on the next reboot. - -Event ID: 2031 -Symbolic name: - -**MALWAREPROTECTION\_OFFLINE\_SCAN\_INSTALL\_FAILED** - -Message: - -**The antimalware engine was unable to download and configure an offline scan.** - -Description: - -Windows Defender has encountered an error trying to download and configure Windows Defender Offline. - -Error Code: -Error Description: -Event ID: 2040 -Symbolic name: - -**MALWAREPROTECTION\_OS\_EXPIRING** - -Message: - -**Antimalware support for this operating system version will soon end.** - -Description: - -The support for your operating system will expire shortly. Running Windows Defender on an out of support operating system is not an adequate solution to protect against threats. - -Event ID: 2041 -Symbolic name: - -**MALWAREPROTECTION\_OS\_EOL** - -Message: - -**Antimalware support for this operating system has ended. You must upgrade the operating system for continued support.** - -Description: - -The support for your operating system has expired. Running Windows Defender on an out of support operating system is not an adequate solution to protect against threats. - -Event ID: 2042 -Symbolic name: - -**MALWAREPROTECTION\_PROTECTION\_EOL** - -Message: - -**The antimalware engine no longer supports this operating system, and is no longer protecting your system from malware.** - -Description: - -The support for your operating system has expired. Windows Defender is no longer supported on your operating system, has stopped functioning, and is not protecting against malware threats. - -Event ID: 3002 -Symbolic name: - -**MALWAREPROTECTION\_RTP\_FEATURE\_FAILURE** - -Message: - -**Real-time protection encountered an error and failed.** - -Description: - -Windows Defender Real-Time Protection feature has encountered an error and failed. - -Feature: -Error Code: -Error Description: -Reason: -User action: - -You should restart the system then run a full scan because it’s possible the system was not protected for some time. - -The Windows Defender client’s real-time protection feature encountered an error because one of the services failed to start. - -If it is followed by a 3007 event ID, the failure was temporary and the antimalware client recovered from the failure. - -Event ID: 3007 -Symbolic name: - -**MALWAREPROTECTION\_RTP\_FEATURE\_RECOVERED** - -Message: - -**Real-time protection recovered from a failure. We recommend running a full system scan when you see this error.** - -Description: - -Windows Defender Real-time Protection has restarted a feature. It is recommended that you run a full system scan to detect any items that may have been missed while this agent was down. - -Feature: -Reason: -User action: - -The real-time protection feature has restarted. If this event happens again, contact [Microsoft Technical Support](http://go.microsoft.com/fwlink/?LinkId=215491). - -Event ID: 5000 -Symbolic name: - -**MALWAREPROTECTION\_RTP\_ENABLED** - -Message: - -**Real-time protection is enabled.** - -Description: - -Windows Defender Real-time Protection scanning for malware and other potentially unwanted software was enabled. - -Event ID: 5001 -Symbolic name: - -**MALWAREPROTECTION\_RTP\_DISABLED** - -Message: - -**Real-time protection is disabled.** - -Description: - -Windows Defender Real-time Protection scanning for malware and other potentially unwanted software was disabled. - -Event ID: 5004 -Symbolic name: - -**MALWAREPROTECTION\_RTP\_FEATURE\_CONFIGURED** - -Message: - -**The real-time protection configuration changed.** - -Description: - -Windows Defender Real-time Protection feature configuration has changed. - -Feature: -Configuration: -Event ID: 5007 -Symbolic name: - -**MALWAREPROTECTION\_CONFIG\_CHANGED** - -Message: - -**The antimalware platform configuration changed.** - -Description: - -Windows Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware. - -Old value: -New value: -Event ID: 5008 -Symbolic name: - -**MALWAREPROTECTION\_ENGINE\_FAILURE** - -Message: - -**The antimalware engine encountered an error and failed.** - -Description: - -Windows Defender engine has been terminated due to an unexpected error. - -Failure Type: -Exception Code: -Resource: -User action: - -To troubleshoot this event: - -1. Try to restart the service. - - For antimalware, antivirus and spyware, at an elevated command prompt, type **net stop msmpsvc**, and then type **net start msmpsvc** to restart the antimalware engine. - - For the *Network Inspection System*, at an elevated command prompt, type **net start nissrv**, and then type **net start nissrv** to restart the *Network Inspection System* engine by using the NiSSRV.exe file. - -2. If it fails in the same way, look up the error code by accessing the [Microsoft Support Site](http://go.microsoft.com/fwlink/?LinkId=215163) and entering the error number in the **Search** box, and contact [Microsoft Technical Support](http://go.microsoft.com/fwlink/?LinkId=215491). - -User action: - -The Windows Defender client engine stopped due to an unexpected error. - -To troubleshoot this event: - -1. Run the scan again. -2. If it fails in the same way, go to the [Microsoft Support site](http://go.microsoft.com/fwlink/?LinkId=215163), enter the error number in the **Search** box to look for the error code. -3. Contact [Microsoft Technical Support](http://go.microsoft.com/fwlink/?LinkId=215491). - -Event ID: 5009 -Symbolic name: - -**MALWAREPROTECTION\_ANTISPYWARE\_ENABLED** - -Message: - -**Scanning for malware and other potentially unwanted software is enabled.** - -Description: - -Windows Defender scanning for malware and other potentially unwanted software has been enabled. - -Event ID: 5010 -Symbolic name: - -**MALWAREPROTECTION\_ANTISPYWARE\_DISABLED** - -Message: - -**Scanning for malware and other potentially unwanted software is disabled.** - -Description: - -Windows Defender scanning for malware and other potentially unwanted software is disabled. - -Event ID: 5011 -Symbolic name: - -**MALWAREPROTECTION\_ANTIVIRUS\_ENABLED** - -Message: - -**Scanning for viruses is enabled.** - -Description: - -Windows Defender scanning for viruses has been enabled. - -Event ID: 5012 -Symbolic name: - -**MALWAREPROTECTION\_ANTIVIRUS\_DISABLED** - -Message: - -**Scanning for viruses is disabled.** - -Description: - -Windows Defender scanning for viruses is disabled. - -Event ID: 5100 -Symbolic name: - -**MALWAREPROTECTION\_EXPIRATION\_WARNING\_STATE** - -Message: - -**The antimalware platform will expire soon.** - -Description: - -Windows Defender has entered a grace period and will soon expire. After expiration, this program will disable protection against viruses, spyware, and other potentially unwanted software. - -Expiration Reason: -Expiration Date: -Event ID: 5101 -Symbolic name: - -**MALWAREPROTECTION\_DISABLED\_EXPIRED\_STATE** - -Message: - -**The antimalware platform is expired.** - -Description:: - -Windows Defender grace period has expired. Protection against viruses, spyware, and other potentially unwanted software is disabled. - -Expiration Reason: -Expiration Date: -Error Code: -Error Description: -  - -## Windows Defender client error codes - - -If Windows Defender experiences any issues it will usually give you an error code to help you troubleshoot the issue. Most often an error means there was a problem installing an update. - -This section provides the following information about Windows Defender client errors. - -- The error code -- The possible reason for the error -- Advice on what to do now - -Use the information in these tables to help troubleshoot Windows Defender error codes. - -External error codes -Error code -Message displayed -Possible reason for error -What to do now -xxxx - -xxxx - -xxxx - -xxxx - -xxxx - -xxxx - -xxxx - -xxxx - -xxxx - -xxxx - -xxxx - -xxxx - -xxxx - -xxxx - -xxxx - -xxxx - -xxxx - -xxxx - -xxxx - -xxxx - -xxxx - -xxxx - -xxxx - -xxxx - -xxxx - -xxxx - -xxxx - -  - -Internal error codes -Error code -Message displayed -Possible reason for error -What to do now -0x80501000 - -**ERROR\_MP\_UI\_CONSOLIDATION\_BAS**E - -This is an internal error. The cause is not clearly defined. - -1. Update the definitions. Either: - 1. Click the **Update definitions** button on the **Update** tab in Windows Defender. ![update definitions in windows defender](images/defender-updatedefs.png) - - Or, - - 2. Download the latest definitions from the [Microsoft Malware Protection Center](http://go.microsoft.com/fwlink/?LinkID=200965). - - Note: The size of the definitions file downloaded from the [Microsoft Malware Protection Center](http://go.microsoft.com/fwlink/?LinkID=200965) can exceed 60 MB and should not be used as a long-term solution for updating definitions. - -2. Run a full scan. -3. Restart the device and try again. - -0x80501001 - -**ERROR\_MP\_ACTIONS\_FAILED** - -0x80501002 - -**ERROR\_MP\_NOENGINE** - -0x80501003 - -**ERROR\_MP\_ACTIVE\_THREATS** - -0x805011011 - -**MP\_ERROR\_CODE\_LUA\_CANCELLED** - -0x80501101 - -**ERROR\_LUA\_CANCELLATION** - -0x80501102 - -**MP\_ERROR\_CODE\_ALREADY\_SHUTDOWN** - -0x80501103 - -**MP\_ERROR\_CODE\_RDEVICE\_S\_ASYNC\_CALL\_PENDING** - -0x80501104 - -**MP\_ERROR\_CODE\_CANCELLED** - -0x80501105 - -**MP\_ERROR\_CODE\_NO\_TARGETOS** - -0x80501106 - -**MP\_ERROR\_CODE\_BAD\_REGEXP** - -0x80501107 - -**MP\_ERROR\_TEST\_INDUCED\_ERROR** - -0x80501108 - -**MP\_ERROR\_SIG\_BACKUP\_DISABLED** - -0x80508001 - -**ERR\_MP\_BAD\_INIT\_MODULES** - -0x80508002 - -**ERR\_MP\_BAD\_DATABASE** - -0x80508004 - -**ERR\_MP\_BAD\_UFS** - -0x8050800C - -**ERR\_MP\_BAD\_INPUT\_DATA** - -0x8050800D - -**ERR\_MP\_BAD\_GLOBAL\_STORAGE** - -0x8050800E - -**ERR\_MP\_OBSOLETE** - -0x8050800F - -**ERR\_MP\_NOT\_SUPPORTED** - -0x8050800F 0x80508010 - -**ERR\_MP\_NO\_MORE\_ITEMS** - -0x80508011 - -**ERR\_MP\_DUPLICATE\_SCANID** - -0x80508012 - -**ERR\_MP\_BAD\_SCANID** - -0x80508013 - -**ERR\_MP\_BAD\_USERDB\_VERSION** - -0x80508014 - -**ERR\_MP\_RESTORE\_FAILED** - -0x80508016 - -**ERR\_MP\_BAD\_ACTION** - -0x80508019 - -**ERR\_MP\_NOT\_FOUND** - -0x80509001 - -**ERR\_RELO\_BAD\_EHANDLE** - -0x80509003 - -**ERR\_RELO\_KERNEL\_NOT\_LOADED** - -0x8050A001 - -**ERR\_MP\_BADDB\_OPEN** - -0x8050A002 - -**ERR\_MP\_BADDB\_HEADER** - -0x8050A003 - -**ERR\_MP\_BADDB\_OLDENGINE** - -0x8050A004 - -**ERR\_MP\_BADDB\_CONTENT** - -0x8050A005 - -**ERR\_MP\_BADDB\_NOTSIGNED** -   ## Related topics diff --git a/windows/manage/introduction-to-windows-10-servicing.md b/windows/manage/introduction-to-windows-10-servicing.md index e6837458dd..3de0e4c19f 100644 --- a/windows/manage/introduction-to-windows-10-servicing.md +++ b/windows/manage/introduction-to-windows-10-servicing.md @@ -286,51 +286,91 @@ Windows 10 Enterprise LTSB does include Internet Explorer 11, and is compatible Table 2. Servicing option summary -Comparison -Windows 10 servicing options -Current Branch (CB) -Current Branch for Business (CBB) -Long-Term Servicing Branch (LTSB) -**Availability of new feature upgrades for installation** -Immediate -Deferred by ~4 months -Not applicable -**Supported editions** -Windows 10 Home, Windows 10 Pro, Windows 10 Education, Windows 10 Enterprise, Windows 10 Mobile, IoT Core, IoT Core Pro -Windows 10 Pro, Windows 10 Education, Windows 10 Enterprise, Windows 10 Mobile Enterprise, IoT Core Pro -Windows 10 Enterprise LTSB -**Minimum length of servicing lifetime** -Approximately 4 Months -Approximately 8 months -10 years -**Ongoing installation of new feature upgrades required to receive servicing updates** -Yes -Yes -No -**Supports Windows Update for release deployment** -Yes -Yes -Yes -**Supports Windows Server Update Services for release deployment** -Yes (excludes Home) -Yes -Yes -**Supports Configuration Manager/configuration management systems for release deployment** -Yes (excludes Home) -Yes -Yes -**First party browsers included** -Microsoft Edge, Internet Explorer 11 -Microsoft Edge, IE11 -IE11 -**Notable Windows system apps removed** -None -None -Microsoft Edge, Windows Store Client, Cortana (limited search available) -**Notable Windows universal apps removed** -None -None -Outlook Mail/Calendar, OneNote, Weather, News, Sports, Money, Photos, Camera, Music, Clock + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ComparisonWindows 10 servicing options
Current Branch (CB)Current Branch for Business (CBB)Long-Term Servicing Branch (LTSB)
Availability of new feature upgrades for installationImmediateDeferred by ~4 monthsNot applicable
Supported editionsWindows 10 Home, Windows 10 Pro, Windows 10 Education, Windows 10 Enterprise, Windows 10 Mobile, +IoT Core, IoT Core ProWindows 10 Pro, +Windows 10 Education, +Windows 10 Enterprise, Windows 10 Mobile Enterprise, +IoT Core ProWindows 10 Enterprise LTSB
Minimum length of servicing lifetimeApproximately 4 MonthsApproximately 8 months10 years
Ongoing installation of new feature upgrades required to receive servicing updatesYesYesNo
Supports Windows Update for release deploymentYesYesYes
Supports Windows Server Update Services for release deploymentYes +(excludes Home) +YesYes
Supports Configuration Manager/configuration management systems for release deploymentYes +(excludes Home) +YesYes
First party browsers includedMicrosoft Edge, +Internet Explorer 11Microsoft Edge, +IE11IE11
Notable Windows +system apps removed +NoneNoneMicrosoft Edge, Windows Store Client, Cortana (limited search available)
Notable Windows +universal apps removed +NoneNoneOutlook Mail/Calendar, OneNote, Weather, News, Sports, Money, Photos, Camera, Music, Clock
  ## Related topics diff --git a/windows/plan/setup-and-deployment.md b/windows/plan/setup-and-deployment.md index f52da706cb..e1b3189738 100644 --- a/windows/plan/setup-and-deployment.md +++ b/windows/plan/setup-and-deployment.md @@ -34,30 +34,62 @@ To use Windows Update for Business, Windows 10-based devices must first be conf Windows Update for Business allows administrators to control when upgrades and updates are deployed to their Windows 10 clients by specifying deferral windows from when they are initially made available on the Windows Update service. As mentioned, there are restrictions as to how long you can delay upgrades and updates. The following table details these restrictions, per deployment category type: -**Group Policy keys** - -HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate\\DeferUpgradePeriod - -- Values: 0-8 where each unit for upgrade is a month - -HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate\\DeferUpdatePeriod - -- Values: 0-4 where each unit for update is a week - -**MDM** - -*./Vendor/MSFT/Update/DeferUpgrade* - -Software\\Microsoft\\PolicyManager\\current\\Update\\RequireDeferUpgrade - -- Values: 0-8 where each unit for upgrade is a month - -Software\\Microsoft\\PolicyManager\\current\\Update\\RequireDeferUpdate - -- Values: 0-4 where each unit for update is a week - -  + + + + + + + + + + + + + + + +
+

Group Policy keys

+
+

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\DeferUpgradePeriod

+
    +
  • +

    Values: 0-8 where each unit for upgrade is a month +

    +
  • +
+
+

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\DeferUpdatePeriod

+
    +
  • +

    Values: 0-4 where each unit for update is a week +

    +
  • +
+
+

MDM

+

./Vendor/MSFT/Update/DeferUpgrade

+
+

Software\Microsoft\PolicyManager\current\Update\RequireDeferUpgrade +

+
    +
  • +

    Values: 0-8 where each unit for upgrade is a month + +

    +
  • +
+
+

Software\Microsoft\PolicyManager\current\Update\RequireDeferUpdate

+
    +
  • +

    Values: 0-4 where each unit for update is a week +

    +
  • +
+
Administrators can control deferral periods with Group Policy Objects by using the [Local Group Policy Editor (GPEdit)](http://go.microsoft.com/fwlink/p/?LinkId=734030) or, for domain joined systems, [Group Policy Management Console (GPMC)](http://go.microsoft.com/fwlink/p/?LinkId=699325). For additional details on Group Policy management see [Group Policy management for IT pros](http://go.microsoft.com/fwlink/p/?LinkId=699282). **Set different deferrals based on update classification in GPedit.msc** diff --git a/windows/plan/windows-update-for-business.md b/windows/plan/windows-update-for-business.md index 21bb74847f..b936f37735 100644 --- a/windows/plan/windows-update-for-business.md +++ b/windows/plan/windows-update-for-business.md @@ -65,31 +65,44 @@ In Windows 10, Windows Update for Business recognizes three deployment categori Both upgrades and updates can be deferred from deployment to client machines by a Windows Update for Business administrator within a bounded rage of time from when those updates are first made available on the Windows Update service. This deferral capability allows administrators to validate deployments as they are pushed to all their Windows Update for Business enrolled clients. The following table defines maximum deferral periods allowed by deployment type: -Category -Maximum deferral -Deferral increments -Classification type -Classification GUID -OS upgrades -8 months -1 month -Upgrade -3689BDC8-B205-4AF4-8D4A-A63924C5E9D5 -OS updates -4 weeks -1 week -Security updates -0FA1201D-4330-4FA8-8AE9-B877473B6441 -Drivers -EBFC1FC5-71A4-4F7B-9ACA-3B9A503104A0 -Updates -CD5FFD1E-E932-4E3A-BF74-18BF0B1BBD83 -Other/non-deferrable -No deferral -No deferral -Definition updates -E0789628-CE08-4437-BE74-2495B842F43B -  + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
CategoryMaximum deferralDeferral incrementsClassification typeClassification GUID
OS upgrades8 months1 monthUpgrade3689BDC8-B205-4AF4-8D4A-A63924C5E9D5
OS updates4 weeks1 weekSecurity updates0FA1201D-4330-4FA8-8AE9-B877473B6441
DriversEBFC1FC5-71A4-4F7B-9ACA-3B9A503104A0
UpdatesCD5FFD1E-E932-4E3A-BF74-18BF0B1BBD83
Other/non-deferrableNo deferralNo deferralDefinition updatesE0789628-CE08-4437-BE74-2495B842F43B
## Related topics