Check antivirus mode before troubleshooting an ignored signature-update schedule

Source facts

In Defender Antivirus passive mode, Windows Update settings control security-intelligence update timing. Defender-specific daily, weekly and interval schedules apply in active mode and are ignored in passive mode. Microsoft still directs administrators to keep antivirus updates current in passive mode. The AMRunningMode property returned by Get-MpComputerStatus distinguishes Normal, Passive and EDR Block Mode. Microsoft Learn.

Applicability

This is a scheduling investigation for Windows endpoints where another product supplies primary antivirus protection and Defender Antivirus remains installed. Establish the actual mode rather than inferring it from the presence of a process or a saved policy. Do not generalize this Windows behavior to another operating system.

DSE recommendation

Confirm the effective antivirus mode and examine the applicable Windows Update configuration before changing Defender-specific schedules. Ask the endpoint owner to compare the intended update timing with the controls that apply in that mode. Avoid repeatedly shortening an inactive schedule or switching the antivirus mode merely to make a scheduling test pass. Keep primary antivirus ownership unchanged unless a separate migration is approved.

Verification

Record the observed mode, relevant update configuration and actual intelligence-update evidence across the expected interval. Compare the result with the mode-specific plan and investigate failed or stale updates through the responsible update path. Keep a separate record of whether the endpoint is reporting fresh data; this check concerns which settings schedule an update, not whether a dashboard timestamp alone proves current protection.

Official references

Microsoft Learn: Defender Antivirus coexistence and operating modes. Source reviewed September 9, 2026.