Defender Update KB2267602 (v1.383.1400.0 and above) drops install error 0x80070643 – reports low memory

[German]Quick question for Windows users and administrators – and specifically for Windows Server administrators – did you encounter Windows Defender signature updates installation errors within the last couple of hours? I'm receiving more and more reader reports that Defender update KB2267602 (versions 1.383.1400.0  and beyond) are causing install errors and is failing. Update: There are workarounds.

Defender Update KB2267602

Update KB2267602 is the so-called "Security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware", si.e. the signature update for all Microsoft antivirus products. According to this Microsoft page, the update raises the signature to version 1.383.1447.0 on March 10, 2023.

Update error 0x80070643 from version 1.383.1400.0 +

German blog reader Rene contacted me via mail (thanks) and reported issues with Defender signature updates since version 1.383.1400.0 and beyond (also 1.383.1419.0) on his Windows Server 2019 environment. He receive update install error 0x80070643. Rene tolde me:

Hello Günter,

I am a diligent reader of your blog. First of all, thank you very much for your work. Great, without reading this I would not dare to install Windows updates in the INF…

Quick question: do you know anything about problems with the latest Defender update, which came this night?

KB2267602 (version 1.383.1419.0) and also KB2267602 (version 1.383.1400.0) are not installed on all our Server 2019s.

This is also the case with my colleagues who support INF .

Is there anything about this in your channels, which you certainly have. :-)

My complete WSUS is red by it… I have from therefore the 1400 update rejected, but also the 1419er makes the same problems….

I think there is something wrong at MS… this can't be so…. But I can't find anything about it on the web yet….

I wanted to inform you briefly… if necessary, an article on your blog is necessary.

A quick search on the web has not given me anything yet, although there are always installation errors for the signature updates of Defender. Rene gave me the following screenshot with the update error 0x80070643.

I last wrote about this error (0x80070643 stands for ERROR_INSTALL_FAILURE, Serious Error During Installation) in July 2022 within my German blog (see Microsoft Defender-Update KB4052623 (Version 4.18.2205.7) liefert Fehler 0x80070643). The error is covered in the post Windows Defender liefert Update-Fehler 0x80070643 from 2016.

Remove a broken signature update

My first attempt would be to remove the installed signatur update using the following commands in an administrative command prompt window:

cd "%PROGRAMFILES%\Windows Defender"
MPCMDRUN.exe -RemoveDefinitions -All
MPCMDRUN.exe -SignatureUpdate

This will remove the signatur update and install the latest update. It's valid for test purposes.

More reports are trickling in

After posting the German edition of this blog article, I received more and more reports about this issue facing admins with Windows Server 2016 /2019. One reader told me, that after digging deeper, he found the install error code 0x80508007 (Not enough RAM), which is definitely wrong – his machine had 4 GByte spare RAM. And he told me, that the commands mentioned above didn't fix the issue.

Another blog reader pointe me to the two days old reddit.com post MSERT broken? 0x8050800C, but I'm not sure, whether it's helpful. Another German admin told me, that the current signatur update 1.383.1447.0 drops the same install error. A second German admin reported a growing thread Windows Defender Updates failing for servers – 0x80508007 Device Low on Memory at reddit.com, discussing the same issue.

Feedback from Microsoft

I reported the issue via Twitter to Microsoft and received the following answer:

Hello there, Günter. Thank you for bringing up the issue with installing Defender signature updates on a Windows Server environment, and we understand how important getting information in this matter. We'd love to direct you to the correct department to get accurate information or help you escalate this case if necessary.

We strongly recommend contacting our Global Support Team by dialing the phone number for your region in this article: https://msft.it/60195QE8f. Our dedicated team there is capable of checking any reports for installing the latest Defender signature updates on a Windows Server or assisting you in escalating or resolving this issue as soon as possible.

We'll stay close to hearing updates from you. Thank you, and keep yourself safe! -Gen

Well, seems your are on your own …

A workaround from a reader

German blog reader Norbert has solved the issue ans found a workaround, that he has shared within this comment – here is the tranlation:

With me mainly 2016'er servers are affected – but could solve the problem in the meantime as follows:

created another pagefile with 4GB size on a sep. disk and restarted, then Defender updated itself automatically

in the log MpSigStub.log in C:\Windows\Temp the error 0x80508007 was logged which points to not enough RAM
which is nonsense since the server load has not changed
an increase of the RAM's from 4GB to 64GB did not bring success, only the additional Pagefile.

Thanks to Norbert – hope that helps.

A 2nd advice from Microsoft

Got a 2nd hint from Microsoft from an employee on Facebook who described the issue as follow:

AV Signature Update failing on Hyper-V Servers / Error code: 0x80508007

We are currently noticing an increasing number of problems with the Defender signature installation with version 1.383.1419.0.

Hyper-V servers and systems without a D partition are particularly affected. As a workaround, you can simply create a D partition, or temporarily change the drive letter of another drive (also CD) to D.

The problem should also be fixed with the emergency signature update 1.383.1507.0.

Simply as a supplement to Norbert's workaround. The MS guy who informed me about the issue with the text above wrote a simple powershell command to create the missign partition D:

New-VHD -Path "C:\TEMPD\TempDisk.vhdx" -Dynamic -SizeBytes 1GB | Mount-VHD -Passthru | Initialize-Disk -Passthru | New-Partition -DriveLetter D -UseMaximumSize |Format-Volume -Confirm:$false -Force

Similar articles:
Windows 11: "Defender trouble" due to updates KB5022845 and KB5022913 (app startup hangs)
Is Microsoft Defender killing applications like Outlook again? (Feb 3, 2023)
Windows deleted shortcuts; Microsoft explains Windows Defender ASR issue Jan. 13, 2023
Microsoft Defender update/ASR deletes desktop shortcuts, taskbar broken, Office apps don't start anymore
High CPU load, fan on full speed; Windows Defender struggles with Dell SupportAssist
Windows Defender reports (false positive) Behaviour:Win32/Hive.ZY (Sept. 4, 2022)