Windows Defender update error 0x80070643: security intelligence will not install

Fix it now

0x80070643 is the HRESULT form of Win32 1603, ERROR_INSTALL_FAILURE – a fatal error during installation, with no component-specific meaning at all. That is why it turns up against unrelated updates, so the first job is to read which item actually failed rather than to start repairing Defender.

Get-MpComputerStatus | Select-Object AMServiceEnabled,AntivirusSignatureVersion,AntivirusSignatureLastUpdated,AMEngineVersion,AMProductVersion
Update-MpSignature

1. Open Settings, Windows Update, Update history and read the name of the item that failed. A security intelligence update and a Windows Recovery Environment update are different problems that share this code.
2. If it is the definitions, run Update-MpSignature in elevated PowerShell; the error it returns is more use than the one in the history list.
3. If that fails, restore the definitions and pull a fresh set from an elevated Command Prompt: "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All then "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -SignatureUpdate.
4. If the failing item is the recovery environment, check the System log for event 4502, “Windows Recovery Environment servicing failed”, with ErrorPhase 2 – that is the recovery partition being too small.
5. Run reagentc /info and note whether WinRE is enabled and which partition holds it.
6. Confirm the outcome with Get-MpComputerStatus and read the signature version and last-updated time.

MpCmdRun -RemoveDefinitions -All restores the installed security intelligence to a previous backup copy or to the original default set. Run the update immediately afterwards rather than leaving the machine on an old set.

If the signature timestamp is today and Windows Security reports itself up to date, you are done. If not, the next section separates the two cases.

Why it happens

0x80070643 carries no diagnostic information. Microsoft publishes 1603 as ERROR_INSTALL_FAILURE, a fatal error during installation, and Windows Update shows the HRESULT form of it for anything that dies inside the servicing path. Everything useful therefore comes from establishing which update produced it, and that is a thirty-second job in Update history that most people skip.

On the Defender side, security intelligence arrives as a small package that the Defender platform applies to its local store. If that store is damaged, or the platform build is broken, or Defender has been put into disabled mode by another antivirus registering itself, the apply step fails. The companion code worth recognising is 0x8007139F, which is the HRESULT form of Win32 5023, ERROR_INVALID_STATE – the resource is not in the correct state to perform the requested operation. That is what a disabled Defender being asked to update looks like.

The recovery environment case has nothing to do with antivirus. WinRE lives on its own small partition and servicing it needs free space there to stage a replacement image. Many factory layouts leave almost none, so the update fails, Windows Update retries it indefinitely, and it sits in the history list looking like a security problem. The signal that tells you this is your case is specific: System event 4502, Windows Recovery Environment servicing failed, with ErrorPhase 2.

0x80073B01 sometimes appears alongside, and it is worth being honest about it. Microsoft does not publish it as a Microsoft Defender Antivirus code. Decoded as an HRESULT it is Win32 15105, ERROR_MUI_FILE_NOT_LOADED, a resource-loader error, which does not support the confident readings you will find elsewhere. Note it, do not build on it.

Repartitioning is the one step here that can cost you data. Take a full backup first, confirm you have your BitLocker recovery key if the drive is encrypted, and follow Microsoft’s published procedure rather than improvising with diskpart on a machine you cannot afford to rebuild.

Full reference

Telling the two cases apart

MpCmdRun, and where it lives

Microsoft documents two locations for MpCmdRun.exe: C:\Program Files\Windows Defender, and the platform folder at C:\ProgramData\Microsoft\Windows Defender\Platform\<version>, with the platform copy being the recommended one because it is the current build. If a command from the Program Files copy behaves oddly on a machine whose platform has been updated many times, try the platform copy.

The events to read, and where

Defender’s own log is Applications and Services Logs, Microsoft, Windows, Windows Defender, Operational. Two entries matter here.

• Event 2001, MALWAREPROTECTION_SIGNATURE_UPDATE_FAILED – the security intelligence update failed. It carries the update source, the update stage (Search, Download or Install), the error code and its description. The stage is the useful part: a failure at Download is a network problem and a failure at Install is not.
• Event 2003, MALWAREPROTECTION_ENGINE_UPDATE_FAILED – the antimalware engine update failed, which is a different package from the signatures and can fail on its own.
• For the recovery-environment case, look in Windows Logs, System for event 4502 rather than in the Defender log at all.

How exposed the machine actually is

Less than the red banner suggests, and more than nothing. Cloud-delivered protection continues to work while the machine is online, so new threats are still checked against Microsoft’s service. What ages is the local set, and the gap widens daily. Treat a machine that has been failing for a week as urgent and one that failed this morning as routine.

When to stop and collect evidence instead

1. Run "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -GetFiles to gather the Defender logs into a cab file.
2. Note the update stage from event 2001, because it tells a support engineer whether to look at the network or the platform.
3. Note the platform, engine and signature versions from Get-MpComputerStatus.
4. Note whether any non-Microsoft antivirus is or has been installed, and whether its registration is still present.
5. Take that set to support rather than reinstalling Windows, which is where people go far too early with this code.

Every code this article covers

Confirm the fix worked

1. Get-MpComputerStatus shows a signature timestamp from today and the antimalware service enabled.
2. Windows Security reports protection as up to date rather than showing a warning.
3. The Defender operational log records a successful update rather than repeating 2001 or 2003.
4. Windows Update history shows the previously failing item as installed, or shows nothing pending.
5. Restart and confirm the next scheduled update also succeeds, rather than only the one you forced.

Questions people ask about this