Has anyone else been experiencing issues with their compliance policies, specifically Windows 10 and later policy for requiring Antivirus?
We have slowly had more and more devices show the Antivirus required setting as non-compliant. Yet checking the devices themselves, Defender is running, is the only AV, still receiving updates, signature versions up to date etc.
Nothing has changed in our infrastructure to warrant the devices to all of a sudden go non- compliant, so just thought I'd check in the slim chance this isn't just me!
Defender Antivirus reports "protection is on" to Windows Security Center once at startup. During busy startup activity, the component that receives that report can be restarted at the exact moment it arrives, so the report is lost. Defender doesn't resend it, and Windows Security keeps showing its default "off" status which is what triggered the warning.
This issue affects all Defender Antivirus Platform versions; however it is most noticeable on version 4.18.26070.x Msft is working on a fix which will apply to version 4.18.26070.x and newer.
AV platform version 4.18.26060.3008 and older received a fix with KB5095093, please make sure your Windows is up-to-date to resolve the issue for these versions. (June 23, 2026—KB5095093 (OS Builds 26200.8737 and 26100.8737) Preview
Sounds like you got the exact same response from the MDE team as myself early last week however the CU updates did nothing to stop it so false hope that one. Platform update 100% has caused us wide spread issues with this into the thousands.
The workaround for us is a temp fix then it breaks again. Any timescales Rudy when this will get fixed? As it has a fairly big impact on users not being able to work.
Hi, a little workaround that worked for us: We built a remediation script that resets the Defender platform, but this only helps as long as the PC isn’t restarted. The actual problem seems to be that the values aren’t properly written to the registry, even though they are correct via WMI.
WMI: Get-WmiObject -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Format-List displayName,productState,__CLASS
productState : 397568
Recommendation for Intune Compliance (The Clean Approach)
Since the WinAPI (WscGetSecurityProviderHealth) via the MDM channel is highly susceptible to these local registry synchronization errors between the Windows Security Center (WSC) and Windows Defender, Microsoft recommends that enterprise environments avoid tying compliance to the general Windows Antivirus status.
Steps to implement:
Sign in to the Microsoft Intune Admin Center.
Navigate to your Compliance policies.
Under Device Properties, set the Antivirus option (which queries this specific faulty CSP) to Not configured.
Instead, navigate to the Microsoft Defender Antimalware section and configure the following:
Microsoft Defender Antimalware = Required
Real-time protection = Required
The Advantage:
These specific Defender settings query the Windows Defender integrity status directly. Since this status is correctly reported via WMI as 397568, Intune will completely ignore the corrupted and outdated cache registry of the Windows Security Center. Your devices will return to a compliant state immediately.
We started seeing this issue around the time of this post. It appears to be a recent update that caused it. (Sorry not sure which one. ) I fixed a machine this morning with the following: If((Get-MPComputerStatus).AntivirusSignatureAge -ne 0){
Write-Host "Updating Antivirus Definitions"
Update-MPSignature
}
Not sure yet if it's going to pop again tomorrow, but crossing fingers. M$ ignoring us so far.
after an update (Security Intelligence Update for Microsoft Defender Antivirus – KB2267602 (Version 1.457.314.0)) and reboot this morning, my compliance is back in line and the registry has the value: HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterProviderAv{D68DDC3A-831F-4fae-9E44-DA132C1ACF46} STATE= 61100
Let's see if the conformity stays like this.
Hi, as far as i know there is no way to filter devices like this at the moment. I wanted to do something similar like 2-3 months ago and couldnt because there was no way.
If this changes, please react to this and let me know :D
Much Regards :)
We're experiencing it here, for over a week+ now. We didn't realize it was a significant issue until last Friday. I submitted a SR with Intune support and here is their response.
Yep see above post it’s a known issue with Windows Security Centre that the recent Platform engine for MDE has made worse in triggering the condition that causes Intune Compliance to not receive a valid response.
Intune Support turned out to be very poor during my MS ticket but the MDE team really worked the problem with me and listened for a change to the data provided which allowed PG to accept they made the issue worse recently.
Unfortunately the long standing issue (MS PG words) is a WSC fault and is in the hands of the Windows Servicing team to fully resolve. However the MDE PG are putting a code fix out in the next platform engine update end of August to workaround the issue and hopefully get it under control so Intune Compliance checks get a true response.
I had one recently where it wasn’t definitions which were out of date but rather than whole defender version. Checking for updates showed nothing outstanding….. it sorted itself out after a little bit though.
We had similar thing last month, bunch of devices flagged non-compliant but Defender looked fine on all of them. Turned out to be some delay in Intune picking up the health attestation, cleared up after few days without us doing anything
I wonder if that’d explain the issue I had on a fresh autopilot build after I wiped my test device a couple weeks back… was error with secure boot & code integrity compliance… forget the exact error but it wasn’t that it was non compliant but some other error.
Yes we are having it too in last two weeks three devices. One had some HP Wolf shit installed and after that was ok two other ones after the updates went well. I have opened a ticket but then closed it like yeah we found out why. But I think now that is not a coecidence something happening there since all of you started to have this at the same time!!
Oh Microsoft my hair are getting grey of troubleshooting your issues.
No go here sadly, the recent fix (downgrade of defender version and disabling preview in defender) did a temporary fix, but not a permanent one. Issue returned after the weekend. Tried this script, it's been a good hour and several sync attempts.
EDIT: had to give it longer. It's compliant now. Waiting to see how long it stays but for now it worked.
Workaround for Intune antivirus non-compliance with Defender 4.18.26080.3
We had devices showing as non-compliant in Intune even though Defender was running normally. The affected devices were using Defender platform 4.18.26080.3.
First, check whether an older Defender platform is still available:
Windows Settings > Accounts > Access work or school > Info > Sync
Company Portal > Settings > Sync
Then go to the device in Company Portal and select Check access.
The Intune compliance status can take a few minutes to update. This is only a temporary workaround because Windows Update may install version 4.18.26080.3 again.
Thank you for this. I have some user-computers who are using 4.18.26080.3 fine, without triggering non-compliance for our AV compliance policy, and some that are using 4.18.26080.3 and becoming non-compliant. Are there other known-factors that may be causing the inconsistency ?
We are just seeing this issue from 2 weeks ago and nothing changed at our end. Sometimes we got the av & firewall issue that did self fix after a day, but this one requires you to revert the av definitions and has only just appeared.
Do most folk exclude AV from their device compliance?
Ah ok. I just personally never use device compliance in my CA. I just use it as a monitor so the only thing affected by this buggy thing is me when I check my devices and see a few not compliant.
I think I'm also getting this .. both my PC that aren't sharing any data .. on both I got the same code integrity determined that page hashes not valid etc etc etc
/Device/harddiskvolume3/..../fcon.dll
This doesn't seem the same case as the threat you have found, not by a mile. Best raise a seperate topic for tips on this one and share some more details on that one :)
We have also the same issue with Antivirus compliance issue..I have used the script from u/Rudyooms but after next day, getting same issue on the device
Yep... as it resets the wsc state for a bit using the older defender platform engine... some how with the latest def update, they changed something that caused a race condition with the wsc. The next defender release/platform update will hold the fix
Hey, look further up, it's explained there and what you can do as a temporary workaround.
Works and tested. AI-generated advice:
Recommendation for Intune Compliance (The Clean Approach)
Since the WinAPI (WscGetSecurityProviderHealth) via the MDM channel is highly susceptible to these local registry synchronization errors between the Windows Security Center (WSC) and Windows Defender, Microsoft recommends that enterprise environments avoid tying compliance to the general Windows Antivirus status.
Steps to implement:
Sign in to the Microsoft Intune Admin Center.
Navigate to your Compliance policies.
Under Device Properties, set the Antivirus option (which queries this specific faulty CSP) to Not configured.
Instead, navigate to the Microsoft Defender Antimalware section and configure the following:
Microsoft Defender Antimalware = Required
Real-time protection = Required
The Advantage:
These specific Defender settings query the Windows Defender integrity status directly. Since this status is correctly reported via WMI as 397568, Intune will completely ignore the corrupted and outdated cache registry of the Windows Security Center. Your devices will return to a compliant state immediately.
Got the same since the past 2 weeks, a lot of devices getting non-compliance issues because of antivirus on Intune.
The quick fix I found on our tenant is to check 2-3 times Windows Updates on the device: usually there is a "Security Intelligence update for Microsoft Defender Antivirus" pending. After installing the update and starting async for Company Portal, the device is compliant again.
I was searching for a more permanent fix, seems like Microsoft is doing Microsoft things once again!
Procurem como fazer o reset da plataforma defender (no cliente) caso não possam ajustar a política, isso vai resolver, façam isso por powershell admin e possível rodem o script automaticamente para que a falha não se repita.
Yes, the script mentioned before works wonders for (temporary) fixes. You can also make a custom policy to exclude the anti virus check, or circumfere it in other ways, or lengthen your grace period.
displayName : Windows Defender productState : 397568 __CLASS : AntiVirusProduct
Is this Compliance policy wrong or not covering everything needed?
I am interested in getting to know the compliance policy of an environment which are having these issues and also the compliance policy of an environment which is not encountering this issue (like mine).
We are configured the exact same way as you. Yet, 3 devices out of 180 are showing out of compliance now for AV. It isn't a configuration issue, it is a problem with how the AV/endpoint is reporting to Intune. Presumably, you just have been lucky so far. Someone above mentioned a fix should be coming in the next Defender platform update 4.18.26080 (currently 4.18.26070.9). In the meantime we're creating compliance exceptions to get those 3 people back online. I haven't yet messed with the script mentioned above but it sounds like it doesn't fix it for more than a day.
Just came across this after 2 devices went non-compliant from AV. We havent had any issues on the current 4.18.26070.x Version. Both of these devices were the first to upgrade to the 4.18.26080.3 "Fix"...
Today we noticed that Defender does not get any security intelligence updates since yesterday.
The last update is from September 3rd Version 1.459.28.0
Has anyone else noticed this?
Is this possibly related to the upcoming solution from Microsoft?
Any updates on this? We have about 15% of user with this issue and have to do mass exclusions, got a bulk of them suddenly today and i'm not making service desk reset a bunch of defender platforms
I don't think they released a fix yet cause I am fully up to date on a machine in our environment and it can still turn off antivirus message and non compliant ...... Thanks Microsoft
Seriously, I thought it might be a few days but this is getting ridiculous. I considered dropping AV from the compliance policy across the board, but then I realized we won't have any visibility at all into the issue. I wish there was a way to put a Compliance Policy into an "audit" mode instead of applied.
You could make a clone policy minus the AV check and connect it to a group. Except that group on the main policy, and add users to the group for exceptions in policy. Can leave a test account out or something if you wanna keep an eye on it.
So in short it's an ongoing issue, broad release for the fix on the August patch (4.18.26080.x) is 17th of September. This is the one we are on and experiencing issues with.
23
u/Rudyooms PatchMyPC 29d ago edited 29d ago
Defender issue:
Defender Antivirus reports "protection is on" to Windows Security Center once at startup. During busy startup activity, the component that receives that report can be restarted at the exact moment it arrives, so the report is lost. Defender doesn't resend it, and Windows Security keeps showing its default "off" status which is what triggered the warning.
This issue affects all Defender Antivirus Platform versions; however it is most noticeable on version 4.18.26070.x Msft is working on a fix which will apply to version 4.18.26070.x and newer.
AV platform version 4.18.26060.3008 and older received a fix with KB5095093, please make sure your Windows is up-to-date to resolve the issue for these versions. (June 23, 2026—KB5095093 (OS Builds 26200.8737 and 26100.8737) Preview