Azure Update Management showing superseded versions of Security Intelligence Update for Microsoft Defender Antivirus - KB2267602

0
votes

I've been having this issue with multiple Azure Virtual Machines for a while now.

I'm using and Azure Automation Account / Log Analytics Workspace to manage updates on 5 different Azure Virtual Machines. It's routinely showing all machines as missing updates, specifically multiple superseded copies of 'Security Intelligence Update for Microsoft Defender Antivirus - KB2267602'

See screenshot below where it's showing versions 1.321.1221.0 through 1.321.1256.0 as missing:

Screenshot of Update Management blade in my Automation Account

However all five Virtual Machines have 1.321.1260.0 installed as shown here:

Screenshot of 'View Update History' from affected Virtual Machine

I know that the Update agent has refreshed since 1.321.1260.0 was installed as 1260.0 was previously showing as missing, however as per the screenshot above it is now not.

I have tried to clear the current cache and trigger an update from CMD using the following script as detailed here:

cd %ProgramFiles%\Windows Defender
MpCmdRun.exe -removedefinitions -dynamicsignatures
MpCmdRun.exe -SignatureUpdate

This runs and completes successfully, but doesn't resolve my issue.

Can anyone suggest why these superseded updates are showing, and/or how to clear them out? They are adversely affecting my otherwise squeaky clean Azure Security Center posture.

Thanks in advance!

1
azureazure-virtual-machineazure-automationazure-security

1 Answers

0
votes

You could try the resolution.

When a superseded update becomes 100 percent not applicable, you should change the approval state of that update to Declined. To change approval state for all your updates:

  1. In the Automation account, select Update Management to view machine status. See View update assessments.

  2. Check the superseded update to make sure that it's 100 percent not applicable.

  3. Mark the update as declined unless you have a question about the update.

  4. Select Computers and, in the Compliance column, force a rescan for compliance. See Manage updates for VMs.

  5. Repeat the steps above for other superseded updates.

  6. Run the cleanup wizard to delete files from the declined updates.

  7. For Windows Server Update Services (WSUS), manually clean all superseded updates to refresh the infrastructure.

  8. Repeat this procedure regularly to correct the display issue and minimize the amount of disk space used for update management.

Refer to https://docs.microsoft.com/en-us/azure/automation/troubleshoot/update-management#scenario-superseded-update-indicated-as-missing-in-update-management