Troubleshoot Windows Defender Antivirus reporting in Update Compliance
You can use Windows Defender Antivirus with Update Compliance. You’ll see status for E3, B, F1, VL, and Pro licenses. However, for E5 licenses, you need to use the Microsoft Defender ATP portal. To learn more about licensing options, see Windows 10 product licensing options.
When you use Windows Analytics Update Compliance to obtain reporting into the protection status of devices or endpoints in your network that are using Windows Defender Antivirus, you might encounter problems or issues.
Typically, the most common indicators of a problem are:
- You only see a small number or subset of all the devices you were expecting to see
- You do not see any devices at all
- The reports and information you do see is outdated (older than a few days)
For common error codes and event IDs related to the Windows Defender Antivirus service that are not related to Update Compliance, see Windows Defender Antivirus events.
There are three steps to troubleshooting these problems:
- Confirm that you have met all pre-requisites
- Check your connectivity to the Windows Defender cloud-based service
- Submit support logs
It typically takes 3 days for devices to start appearing in Update Compliance.
In order for devices to properly show up in Update Compliance, you have to meet certain pre-requisites for both the Update Compliance service and for Windows Defender Antivirus:
- Endpoints are using Windows Defender Antivirus as the sole antivirus protection app. Using any other antivirus app will cause Windows Defender AV to disable itself and the endpoint will not be reported in Update Compliance.
- Cloud-delivered protection is enabled.
- Endpoints can connect to the Windows Defender AV cloud
- If the endpoint is running Windows 10 version 1607 or earlier, Windows 10 diagnostic data must be set to the Enhanced level.
- It has been 3 days since all requirements have been met
“You can use Windows Defender Antivirus with Update Compliance. You’ll see status for E3, B, F1, VL, and Pro licenses. However, for E5 licenses, you need to use the Microsoft Defender ATP portal (https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints). To learn more about licensing options, see Windows 10 product licensing options"
If the above pre-requisites have all been met, you might need to proceed to the next step to collect diagnostic information and send it to us.