Microsoft Now Requires DISM for Manual Defender Updates on Windows 11 24H2 — Here’s the Full Playbook

Windows 11 24H2's rollout brought a quiet but critical shift: Microsoft now explicitly warns against double-clicking MSU update packages for manual installations, instead requiring admins to adopt DISM-based offline servicing. For security teams tasked with keeping Microsoft Defender current on air-gapped servers, stale deployment images, or broken Windows Update clients, this mandate reshapes established workflows that once relied on simple executable installers or quick PowerShell cmdlets. The change, documented in Microsoft's updated guidance for checkpoint cumulative updates, means that what was a straightforward fallback is now a multi-step administrative ritual requiring meticulous sequencing and validation.

The Two-Part Defender Update Mechanism

Microsoft Defender ships its protection in two distinct layers. Security intelligence updates, released multiple times daily, carry the latest malware signatures and heuristic detections. Platform and engine updates arrive less frequently — typically monthly — delivering deeper improvements to the scanning engine, behavior monitoring, and remediation logic. The security intelligence package is the familiar mpam-fe.exe or mpam-feX64.exe, while platform updates appear as KB4052623 variants. Both must be maintained, but the recent checkpoint update model introduced in Windows 11 24H2 ties platform servicing to a chain of cumulative patches that cannot be simply installed by clicking an MSU file if the system has received additional Feature on Demand (FoD) or language packs.

Why Manual Updates Remain Essential

Three scenarios dominate. Freshly imaged machines often contain stale definitions baked into the install media, leaving them blind to threats during the critical first hours after deployment. Air-gapped networks in defense, industrial control, or regulated environments cannot reach Windows Update, making manual package transfer the only viable path. And when Windows Update itself fails — with errors like 0x80070643 cited in Microsoft's own community forums — a fallback plan keeps anti-malware coverage alive while the root cause is diagnosed.

A Microsoft Community Support Specialist recently walked a user through such a failure, recommending a sequence that started with disabling third-party antivirus, manually triggering a Defender update through Windows Security, resetting Windows Update components, and finally downloading the latest definitions from the Security Intelligence portal. That thread, viewed by thousands, underscores how frequently automatic channels break.

Community Confirmation: Real-World Failure and Fix

The error code 0x80070643 typically indicates a problem with installing updates, particularly related to Microsoft Defender Antivirus or other security updates. The community specialist provided a step-by-step troubleshooting guide:

• Temporarily disable third-party antivirus software.
• Open Windows Security → Virus & threat protection → Check for updates.
• Reset Windows Update components (stop wuauserv, cryptSvc, bits, msiserver; rename SoftwareDistribution and Catroot2 folders; restart services).
• Update .NET Framework.
• Perform a clean boot to eliminate software conflicts.
• Manually download and install the latest security intelligence from the Microsoft Security Intelligence page.

This escalation path mirrors the broader manual update playbook, confirming that even Microsoft support engineers default to these methods when automatic channels fail.

Quick Manual Methods: A Tiered Approach

1. Windows Security GUI (First Line)

Open Windows Security → Virus & threat protection → Protection updates → Check for updates. This triggers an immediate fetch from the configured source and is the simplest first step.

2. PowerShell — Scriptable and Remote-Capable

Run an elevated PowerShell session and execute:

Update-MpSignature

To specify a source, use:

Update-MpSignature -UpdateSource MicrosoftUpdateServer

The Update-MpSignature cmdlet respects the configured SignatureFallbackOrder and is the preferred programmatic method.

3. MpCmdRun — Low-Level Rescue Tool

When the GUI and PowerShell fail, use the Defender command-line tool:

\"%ProgramData%\\Microsoft\\Windows Defender\\Platform\\<version>\\MpCmdRun.exe\" -removedefinitions -dynamicsignatures
\"%ProgramData%\\Microsoft\\Windows Defender\\Platform\\<version>\\MpCmdRun.exe\" -SignatureUpdate

This clears cached dynamic definitions then forces a fresh download.

4. Offline Executable Installer

For air-gapped or emergency scenarios, download the latest mpam-feX64.exe from the Microsoft Security Intelligence page and run it as administrator. This installs definitions without any network contact.

Step-by-Step for a Single PC

1. Try the GUI: Windows Security → Check for updates. If successful, stop.
2. PowerShell: Run Update-MpSignature. If error, try Update-MpSignature -UpdateSource mmpc.
3. MpCmdRun: Remove dynamic signatures and force update.
4. Offline package: Execute mpam-feX64.exe.
5. Verify: Check the security intelligence version in Windows Security.

Enterprise Deployment: Offline Servicing and the DISM Mandate

For fleets, the challenge scales. System Center and Intune administrators push Update-MpSignature remotely, but the real heavy lifting involves servicing gold images so new endpoints boot with current Defender definitions.

Microsoft now prescribes a DISM-centric workflow for Windows 11 24H2 and beyond:

• Download the required MSU/CAB files — including all preceding checkpoint cumulative updates — from the Microsoft Update Catalog.
• Mount the install.wim or VHD.
• Apply packages sequentially with DISM /Add-Package.
• Commit, unmount, and export the image.
• Inject the latest mpam-feX64.exe into the image’s Defender platform directory.

This sequence is mandatory because checkpoint cumulative updates break the monolithic update model. When a device receives a Feature on Demand or language pack locally, subsequent cumulative updates expect all previous checkpoints. Double-clicking an MSU on such a system triggers an \"Operation is not supported\" error. Microsoft’s official resolution: use DISM for offline servicing, or sequence updates via the catalog. For Defender platform updates, this means admins can no longer simply run the MSU; they must integrate it into the image properly.

Troubleshooting Common Failures

Symptom: Virus & threat protection won’t update
Run the Windows Update Troubleshooter (Settings → System → Troubleshoot).

Symptom: Error 0x80070643 or 0x80072ee2
- Disable third-party AV temporarily.
- Reset Windows Update components (stop services, rename folders, restart services).
- Run SFC /scannow and DISM /Online /Cleanup-Image /RestoreHealth.
- Update .NET Framework.
- Perform a clean boot.
- Try Update-MpSignature or MpCmdRun after each step.

Symptom: Platform version stuck
Platform updates (KB4052623) follow a different cadence. Verify installation via Windows Update or Update Catalog. If stuck, roll back and reapply using DISM.

Symptom: \"Operation is not supported\" on MSU double-click
This is the checkpoint update conflict. Apply all relevant checkpoint cumulative updates via DISM as described above.

Automation for the Fleet

• Use PowerShell remoting or Intune to execute Update-MpSignature on endpoints.
• For air-gapped networks, maintain a secure UNC share with the latest mpam-feX64.exe and platform packages, synced from a hardened internet-connected proxy.
• Script verification that compares the version number on endpoints to the share’s canonical version.
• Embed MpCmdRun calls in remediation scripts with logging for audit trails.

Security Hygiene for Manual Updates

• Download packages only from the Microsoft Update Catalog or the Security Intelligence portal. Third-party mirrors risk malware injection.
• Verify every package: SHA-2 signing is mandatory for Defender definitions since 2019. Validate checksums and metadata.
• Never double-click MSUs on 24H2+ unless you are certain the checkpoint chain is intact; default to DISM.

A Production Image Case Study

A financial services datacenter admins follows this workflow: mount Windows 11 24H2 install.wim, apply the latest checkpoint cumulative update and Defender platform update via DISM, copy mpam-feX64.exe into ProgramData\Microsoft\Windows Defender\Platform, commit and rebuild. A test VM boots with Windows Security reporting current protection. This eliminates the first-boot gap and aligns with Microsoft’s supported paths.

Microsoft’s Official Guidance

• The Security Intelligence page explicitly describes manual download and install procedures for offline scenarios.
• Update-MpSignature is a supported cmdlet, and -UpdateSource allows pointing to internal sources.
• Checkpoint cumulative update docs direct users to DISM for offline image servicing.
• Independent outlets like Computerworld and WebProNews have documented these steps, often citing the same community failure threads.

Practical Checklist for Administrators

• Maintain a centralized, secure update repository (UNC share or WSUS/SUP).
• For image servicing, always use DISM and include all checkpoint cumulative predecessors.
• Script Update-MpSignature and MpCmdRun for rapid remediation with logging.
• Avoid double-click MSU installs on Windows 11 24H2+; prefer DISM or sequential catalog application.
• Train helpdesk staff on the escalation: GUI → PowerShell → MpCmdRun → offline executable.
• Verify every package’s source and signature.

Critical Analysis: Strengths and Limitations

Strengths: Microsoft provides multiple officially supported manual update avenues — GUI, PowerShell, MpCmdRun, offline packages — offering flexibility and redundancy. This is excellent for operational resilience.

Limitations: The checkpoint cumulative update model complicates offline servicing, demanding deeper DISM expertise. Manual processes, if poorly controlled, introduce risk: a misapplied package can break the servicing stack. Version numbers change multiple times per day; any fixed guide must reference Microsoft’s live portal for the exact current version. Smaller IT shops may struggle with the increased complexity, potentially leaving gaps.

Conclusion

Manual Defender updating on Windows 11 is not a nostalgic hack; it is a required competency for any organization that manages secure endpoints. The tools exist, but Microsoft’s recent changes have made the path narrower and more regimented. Mastering Update-MpSignature, MpCmdRun, and DISM image servicing is no longer optional — it’s the difference between a patched system and an exposed one. Embrace the PowerShell and DISM workflows, cement them into standard operating procedures, and never, ever double-click an MSU again on a 24H2 box without understanding the checkpoint chain.