Microsoft Defender began crashing during Quick and Full scans on August 18 after a security intelligence update rolled out to Windows 10 and Windows 11 devices. Users and system administrators reported the antimalware engine stopping abruptly and displaying a "Threat service has stopped. Restart it now" warning that could not be cleared by restarting the service.

The failures affected both consumer PCs and enterprise endpoints managed through Microsoft Defender for Endpoint, including clean Windows installations. Event Viewer logs on affected machines showed crashes in mpengine.dll with exception code 0xC0000005, an access-violation error, while Offline scans repeatedly stalled around 90–93% completion.

What's new

  • Affected engine versions: 1.1.26070.7 and 1.1.26080.2
  • Affected Security Intelligence versions: 1.457.222.0 through 1.457.230.0
  • Fixed Security Intelligence version: 1.457.236.0 or newer
  • Primary symptom: MsMpEng.exe crashes during manual scans; WinDefend service timeouts
  • Workaround: Run Windows Update to pull the fixed definitions, or use MpCmdRun.exe -RemoveDefinitions -DynamicSignatures followed by MpCmdRun.exe -SignatureUpdate

Security researcher Aryeh Goretsky and multiple Reddit users confirmed that upgrading to Security Intelligence version 1.457.236.0 resolved the crashes. The problematic definitions were delivered through the normal Windows Update channel, so the fix arrives the same way.

Microsoft's official troubleshooting documentation for Defender service startup problems recommends verifying the WinDefend, WdFilter, WdNisSvc, and related services are running, removing conflicting third-party antivirus software, and resetting the platform with MpCmdRun.exe -RemoveDefinitions -All and MpCmdRun.exe -ResetPlatform if the service remains unhealthy.

Why it matters

Because Defender is enabled by default on hundreds of millions of Windows devices, a faulty engine or intelligence update immediately affects both home users and centrally managed corporate fleets. Organizations relying on Defender for Endpoint should verify that endpoints have received the 1.457.236.0 or newer intelligence package and consider running an alternative trusted scanner for additional assurance while the update propagates.

Our take

The rapid community identification of the fixed definition version — before an official Microsoft advisory — highlights how dependent Windows security has become on silent, automatic intelligence updates. Administrators should script the Get-MpComputerStatus check into their monitoring to catch similar regressions early.

Sources