Defender update frequency normal?

Updated Windows Defender a few minutes ago. The WD Scheduled tasks were reset and the WD Verification task was reenabled. Will also wait to see if Windows Module Installer restore points are still being created. So far , so good. Mark

Windows Defender Platform was just updated here. Then I manually ran the WD Verification Task and according to the CBS log and the time stamps, it's still creating restore points

Note: I have Restore Points turned off, so I all I got to go by is the CBS log

Hmmmm? I've got Restore turned off too, I've had two WD Definition updates and as of yet NO Restore Points created.

LOL I've got another problem I'm dealing with. AGAIN!

Eagle51 said:

Windows Defender Platform was just updated here. Then I manually ran the WD Verification Task and according to the CBS log and the time stamps, it's still creating restore points

Note: I have Restore Points turned off, so I all I got to go by is the CBS log

Try this method, it WILL turn system restore off...

Click Start button, click Run and type gpedit.msc
Navigate to Computer Configuration, Administrative Templates, System, System Restore.
Double-click "Turn off System Restore," set it to Disabled, then click OK.

Edit: You should reboot after making changes just to make sure it works.

Hmmmm? I've got Restore turned off too, I've had two WD Definition updates and as of yet NO Restore Points created.

1. As you know, having Restore turned off ... it won't actually create any restore points. You'll have to search the CBS log for "restore point" to see that it tried to create one.
2. There was an update today for Windows Defender Antivirus antimalware platform - KB4052623 (Version 4.18.1809.2) and we were hoping MS had fixed/undone the WD Verification Task creating daily restore points.

Code:

2018-09-25 13:57:35, Info                  CBS    Exec: Creating restore point: Package: Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~10.0.17134.1, current: Installed, targeted: Installed
2018-09-25 13:57:35, Info                  CBS    Restore point type: Install
2018-09-25 13:57:35, Info                  CBS    Perf: Begin: nested restore point - begin
2018-09-25 13:57:35, Info                  CBS    Failed setting restore point [HRESULT = 0x80070422 - ERROR_SERVICE_DISABLED]
2018-09-25 13:57:35, Info                  CBS    Exec: Begin: nested restore point - failed, ignoring and continuing. [HRESULT = 0x80070422 - ERROR_SERVICE_DISABLED]

OK, I just ran a check for updates and got this:

Not the same Version you're showing. A search on my C:\Windows\Logs\CBS\CBS.log has no mention anywhere of a Restore Point.

Still no Restore Points though.

Maybe a fluke...but...
1. I have system restore on. The verification task ran early yesterday in the afternoon and the Windows Modules Installer did set a restore point.
2. I received the antimalware platform update last night.
3. Defender ran the verification task 15 minutes ago. So far, there is no sign of a restore point being set.
I'm keeping an eye on it to see what happens in the coming days. Fingers crossed!

Cool ... hopefully MS has stopped it from creating daily restore points. Curious as to what your CBS log shows for the WD Verification Task that ran 15 mins ago ???

Not the same Version you're showing. A search on my C:\Windows\Logs\CBS\CBS.log has no mention anywhere of a Restore Point.
Still no Restore Points though.

Yea, that's just a Definition Update and far as we know they don't have anything to do with the WD Verification Task creating restore points ... Check your Update History and see if you have Windows Defender Antivirus antimalware platform - KB4052623 ???

BTW ... as you know ... with System Restore turned off it can't create any restore points, so you won't see any :)

BTW ... as you know ... with System Restore turned off it can't create any ... That was my whole idea turning it off. Macrium Reflect will hopefully save MA if I need it.

Well to add to the mystery, I had not gone back to check on the task being disabled since I did disable it. Well it was Enabled but not run! I disabled it again and now we wait and see ...