Update to Windows Defender (KB4052623) fails - labelled security risk!

I have a laptop running Windows 10 version 20H2. I have just tried to update it, using the normal updating process. A Security Intelligence update KB2267602 downloaded and installed successfully. But the other update offered, an "Update for Microsoft Defender Antivirus antimalware platform KB4052623 (Version 4.18.2202.4)" failed.

A retry failed. So I ran the Update Troubleshooter and tried again. Failure. I did Disk Cleanup and tried again. Failure. The error code given is 0x80070643. So (both puzzled and curious) I then thought I would look at the Microsoft Update Catalog and perhaps download this update directly and install it.

I found it listed, and hit "Download". There are three .exe files. They would not download. And - here is the real reason for my forum post - when I right-clicked to bring up the Firefox browser download info popup, all three files were listed with a warning "File not downloaded: Potential security risk". Eh???

What is going on? I don't have any additional or alternative antivirus software installed, so I'm relying on Windows Defender. I would quite like diagnosis/explanation/solution rather than having to move to the radical step of a system reinstall. What further checks or troubleshooting steps should I take, and in what order?

Hmm i should prefer manual update to this if it won't allow straight update.

br1anstorm said:

an "Update for Microsoft Defender Antivirus antimalware platform KB4052623 (Version 4.18.2202.4)" failed.

I am running the same version of Windows and have successfully installed the same version of KB4052623 via a script.



Try running the following command from Command Prompt.

"%ProgramFiles%\Windows Defender\MpCmdRun.exe" "-SignatureUpdate"

If it failed, try using Download Windows Update MiniTool - MajorGeeks

If it failed, run the following command to reset the platform:

"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -resetplatform

After resetting it, run the following again:

"%ProgramFiles%\Windows Defender\MpCmdRun.exe" "-SignatureUpdate"

If it still failed, run the following script and see whether there is something wrong with your system:

👉 Tuneup_plus_log.bat ✔️

Source: Batch files for use in BSOD debugging

Create a system restore point before running the said commands.

Thanks to all who replied. The post from @Bree explains very clearly how and why I got the security warning when trying to download the KB4052623 update directly. Seems quite bizarre that Microsoft - for their own security software downloads/updates - uses methods which trigger security warnings from Firefox and Edge. Does no-one in MS recognise how stupid that makes them look?

As to the original issue of the pesky update-that-wouldn't, the problem seems either to have gone away or solved itself. As well as that security update, I was offered the optional feature update to the system (to version 21H2). So I thought I might as well go for it. That is now installed - and the Update Manager no longer tells me that KB4052623 won't download. So I'm assuming that either it is somehow incorporated within the feature update, or it is no longer needed.

Bree said:

There is nothing wrong with your system, it is behaving correctly. This is a well known issue. The reason for the 'potential security risk' is that the download link is to an http: url, not a secure https: server. Goodness knows why MS do it this way, but that's how Microsoft have been doing it for years. It's only recently that Firfox has started warning about such insecure downloads.

It is in fact safe to download these Microsoft catalog links. To do that in Firefox, click the arrow at the right of the download warning...



...to get this, where you can allow the download:



And it doesn't help using Microsoft's own Edge, that too will not download until you jump through a few hoops.

Microsoft has finally switched their http download.windowsupdate.com links to the more secure https catalog.s.download.windowsupdate.com links last Sat. April 2 so these workaround tips are no longer needed. download KB4052623 again from recent Chrome, MS Edge & Firefox versions as normal without having to do all this - the links should now point to the new catalog.s.download.windowsupdate.com site

Version 4.18.2203.5 was just installed automatically via VBScript.

KB4052623 (Version 4.18.2205.7) wouldn't install on my Win11 Pro 20H2 machine. I have Hyper-V enabled and run some VMs. I manually enabled the insider preview (E5-2667 v4 Xeon not supported, meh) for the beta channel and installed the latest preview build from there (22H2 - 22622.436). Had to clear/reset the Windows Update cache afterwards but KB4052623 (Version 4.18.2205.7) installed fine first try after the upgrade. So it seems they fixed whatever was causing the issue in 20H2.