# Check antivirus mode before troubleshooting an ignored signature-update schedule

> Which update settings govern Defender Antivirus security intelligence in passive mode?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-534-check-antivirus-mode-before-troubleshooting-an-ignored-signature-update-schedule/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:23:02+00:00
- Modified: 2026-09-10T02:11:18+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

Which update settings govern Defender Antivirus security intelligence in passive mode?

## Potentially affected

Windows endpoints running Microsoft Defender Antivirus in passive mode alongside another primary antivirus product.

## DSE recommendation

Confirm the effective antivirus mode and examine the applicable Windows Update configuration before changing Defender-specific schedules.

## Article

## Source facts

In Defender Antivirus passive mode, Windows Update settings control security-intelligence update timing. Defender-specific daily, weekly and interval schedules apply in active mode and are ignored in passive mode. Microsoft still directs administrators to keep antivirus updates current in passive mode. The AMRunningMode property returned by Get-MpComputerStatus distinguishes Normal, Passive and EDR Block Mode. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-compatibility).

## Applicability

This is a scheduling investigation for Windows endpoints where another product supplies primary antivirus protection and Defender Antivirus remains installed. Establish the actual mode rather than inferring it from the presence of a process or a saved policy. Do not generalize this Windows behavior to another operating system.

## DSE recommendation

Confirm the effective antivirus mode and examine the applicable Windows Update configuration before changing Defender-specific schedules. Ask the endpoint owner to compare the intended update timing with the controls that apply in that mode. Avoid repeatedly shortening an inactive schedule or switching the antivirus mode merely to make a scheduling test pass. Keep primary antivirus ownership unchanged unless a separate migration is approved.

## Verification

Record the observed mode, relevant update configuration and actual intelligence-update evidence across the expected interval. Compare the result with the mode-specific plan and investigate failed or stale updates through the responsible update path. Keep a separate record of whether the endpoint is reporting fresh data; this check concerns which settings schedule an update, not whether a dashboard timestamp alone proves current protection.

## Official references

[Microsoft Learn: Defender Antivirus coexistence and operating modes](https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-compatibility). Source reviewed September 9, 2026.

## Primary reference

- Name: Microsoft Defender Antivirus compatibility with other security products - Microsoft Defender for Endpoint | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-compatibility
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check antivirus mode before troubleshooting an ignored signature-update schedule,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-534-check-antivirus-mode-before-troubleshooting-an-ignored-signature-update-schedule/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.