If you open Windows Update and see KB2267602 listed — again — you are not imagining it. It was there yesterday. It was there the day before. It will probably be there tomorrow.
This is not a bug. This is not a Windows Update problem. KB2267602 behaves differently from every other KB number in Windows Update, and understanding why is the key to knowing when to be concerned and when to ignore it entirely.
This guide explains exactly what KB2267602 is, why it appears every single day, what every error code means, and how to fix each one.
What Is KB2267602?
KB2267602 is the Security Intelligence Update for Microsoft Defender Antivirus. It is not a one-time cumulative Windows patch. The KB number stays the same while the definition version changes constantly as Microsoft ships new threat signatures and detection logic.
Every other KB number in Windows Update refers to a fixed package — KB5101650, for example, is the July 2026 Patch Tuesday update for Windows 11. Once installed, that KB number leaves your update queue and does not come back.
KB2267602 is different. Microsoft describes it as a named update stream. The KB number is permanent. What changes is the version number inside it — for example, Version 1.445.492.0 today, Version 1.446.001.0 tomorrow.
Think of it this way: KB2267602 is the container. Microsoft fills that container with new threat intelligence every day — sometimes multiple times per day — and ships the new version through Windows Update. Each new version gets a new version number, but the KB identifier stays the same.
Microsoft continually updates security intelligence in antimalware products to cover the latest threats. Security intelligence ships far more often than engine or platform updates — you may see KB2267602 multiple times in a single day.
Why KB2267602 Appears Every Day — Is It Normal?
Yes. This is completely normal behavior.
KB2267602 is the universal KB listed for every new version of the Defender definition updates. Microsoft collects data about known malware threats and creates a new definition update at least once a day. Defender’s platform engine is normally updated once a month. Security Center app may be updated whenever needed.
When you see KB2267602 in Windows Update, Microsoft has pushed a new version of Defender’s threat database — new malware signatures, new detection rules, updated heuristics. Your system is being offered the latest threat intelligence.
Installing it and seeing it reappear the next day is not a failure. It means Defender is working exactly as intended — staying current with threats that did not exist yesterday.
The confusion arises because users expect a KB number to disappear from Windows Update once installed. KB2267602 is the exception to that pattern.
KB2267602 vs Regular Windows Updates — Key Differences
| KB2267602 | Standard KB (e.g. KB5101650) | |
|---|---|---|
| Update type | Security intelligence | Cumulative OS update |
| Frequency | Daily or multiple times daily | Monthly (Patch Tuesday) |
| KB number | Always KB2267602 | Unique per update |
| Version changes | Yes — constantly | Fixed once released |
| Disappears after install | No — new version next day | Yes — leaves queue |
| Restart required | No | Usually yes |
| Size | Small (a few MB) | Large (500MB+) |
Understanding this table explains why KB2267602 behaves so differently from updates like KB5101650 — the July 2026 Patch Tuesday update that fixed 570 vulnerabilities and added Point-in-time Restore. That was a one-time package. KB2267602 is a continuous stream.
When KB2267602 Is Failing — How to Tell the Difference
The key question is: is KB2267602 installing successfully and then reappearing normally — or is it genuinely failing?
How to check:
Open Windows Security. Go to Virus and threat protection. Click Virus and threat protection updates. Look at the Security intelligence version and the date it was last updated.
If the version date shows today or very recently, KB2267602 is installing successfully. The new version appearing in Windows Update tomorrow is normal behavior — not a failure.
If this check succeeds and the Security intelligence version advances, the failure for that specific KB may have been transient and can be ignored.
If the Security intelligence version has not updated in several days, or if Windows Update is showing an explicit error code next to KB2267602, you have a genuine installation failure that needs to be fixed.
Every Common KB2267602 Error — And How to Fix Each One
Error 0x80070643 — Fatal Error / Most Common
This is the most reported KB2267602 error. It appears when the Defender update component encounters a fatal failure during installation.
0x80070643 means fatal error. There is a possibility that the system image has been corrupted or that the Defender component has become inconsistent.
Fix 1 — Clear Defender definitions manually
Open Command Prompt as administrator and run:
cd "C:\Program Files\Windows Defender"
MpCmdRun.exe -removedefinitions -dynamicsignaturesThis removes the current dynamic definitions and forces Defender to download a fresh set. After running this command, go to Windows Security, Virus and threat protection, and click Check for updates to reinstall.
Fix 2 — Run SFC and DISM
Open Command Prompt as administrator and run:
sfc /scannowWait for it to complete. Then run:
dism /online /cleanup-image /restorehealthRestart and try Windows Update again.
Fix 3 — Check if third-party antivirus is conflicting
If you have installed third-party antivirus software, uninstall it and then check whether KB2267602 installs correctly. Two antivirus programs running simultaneously on the same machine frequently conflict during definition updates. If you use ESET, Kaspersky, McAfee, or any other third-party security product alongside Windows Defender, try temporarily disabling it and retrying the Defender update.
Fix 4 — Install manually
Download the latest Defender definitions directly from Microsoft’s security intelligence page at microsoft.com/en-us/wdsi/defenderupdates. Download the package matching your system architecture — x64 for 64-bit Windows, x86 for 32-bit — and run it directly. This bypasses Windows Update entirely for the definition update.
Error 0x8024402C — Network Timeout
This error means Windows Update could not connect to Microsoft’s update servers to download the definition package.
Fix 1 — Run Windows Update Troubleshooter
Go to Settings, System, Troubleshoot, Other troubleshooters. Run Windows Update. The troubleshooter checks for network connectivity issues, blocked ports, and misconfigured proxy settings automatically.
Fix 2 — Check proxy and firewall settings
If you are behind a corporate firewall or proxy, ensure that the Windows Update service URLs are not blocked. Microsoft publishes the required URLs for Windows Update connectivity in its documentation.
Fix 3 — Reset Windows Update network components
Open Command Prompt as administrator and run:
netsh winsock reset
netsh int ip reset
ipconfig /flushdnsRestart your computer and try again.
Error 0x80070070 — Insufficient Disk Space
Windows cannot install KB2267602 because there is not enough free space on the system drive.
Fix:
Open File Explorer, right-click your C: drive, and check Properties to see available space. Windows Update requires a minimum of several hundred MB free to process updates. Run Disk Cleanup — search for it in the Start menu, select your C: drive, and let it remove temporary files. If space is still critically low, use Settings, Storage, Storage Sense to identify and remove large files.
KB2267602 Endless Loop — Keeps Installing and Failing Repeatedly
Some users experience KB2267602 entering an endless installation loop — the update appears to start installing, shows 0% progress, then resets and starts again without ever completing.
This typically occurs because Windows Update pulls down a new version before the previous installation is fully complete. MpSigStub.exe may still be running in the background when Windows Update attempts to install the next version, causing the subsequent install to fail and triggering another attempt.
Fix 1 — Wait and let it complete
Before troubleshooting, check Task Manager for MpSigStub.exe in the Processes list. If it is running, the previous Defender definition update is still applying in the background. Wait for it to finish — this can take several minutes — before Windows Update will be able to deliver the next version cleanly.
Fix 2 — Restart Windows Update services
Open Command Prompt as administrator and run:
net stop wuauserv
net stop WinDefend
net stop cryptSvc
net stop bits
net start bits
net start cryptSvc
net start WinDefend
net start wuauservThen run Windows Update again.
Fix 3 — Clear Windows Update cache
Open Command Prompt as administrator and run:
net stop wuauserv
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
net start wuauservThis forces Windows Update to re-download the definition package fresh rather than retrying from a potentially corrupted cached file.
KB2267602 Failing After System Image Restore
If you restored a previous Windows system image and KB2267602 is now failing, the issue is typically that Defender’s state and the definition database are inconsistent after the restore.
Fix:
Run the manual definitions clear:
cd "C:\Program Files\Windows Defender"
MpCmdRun.exe -removedefinitions -allThen go to Windows Security and click Check for updates to download the current definition set from scratch. The -all flag removes all definitions including the platform definitions, not just the dynamic signatures — use this specifically after a system image restore.
ESET or Third-Party Antivirus Keeps Warning About KB2267602
ESET and similar security products monitor Windows Defender’s definition currency as part of their system health checks. When Microsoft releases a new KB2267602 version, ESET detects that Defender’s definitions are now out of date and generates a warning — even multiple warnings per day if new Defender versions are shipping frequently.
This is not a malfunction in ESET. It is ESET correctly identifying that a Defender update is available. The warnings stop briefly after Defender updates, then reappear when the next Defender definition version ships.
The fix depends on your intended setup:
If you want Windows Defender active alongside ESET, ensure Defender’s real-time protection is enabled and that automatic updates are turned on. ESET and Defender can run in a limited coexistence mode, but ESET’s warnings about Defender definitions will continue whenever new versions are available.
If you intend to use ESET exclusively and disable Defender, disable Windows Defender through Windows Security settings. ESET will then manage all antivirus functions and the KB2267602 warnings will stop.
If you want to suppress the notifications without changing your setup, check ESET’s notification settings for Defender health monitoring — most ESET products allow you to silence specific health check categories.
How to Verify KB2267602 Is Installing Correctly
Method 1 — Windows Security
Open Windows Security, go to Virus and threat protection, click Virus and threat protection updates. The Security intelligence section shows the current definition version and the last update date and time. If this shows today’s date and a current version number, KB2267602 is installing correctly.
Method 2 — PowerShell
Open PowerShell as administrator and run:
powershell
Get-MpComputerStatus | Select-Object AntivirusSignatureLastUpdated, AntivirusSignatureVersionThis returns the exact timestamp and version of your current Defender definitions.
Method 3 — Windows Update History
Go to Settings, Windows Update, Update History. You will see multiple KB2267602 entries — one for each definition version that has installed. A long list of successfully installed KB2267602 entries confirms the update stream is working correctly.
Should You Be Concerned About KB2267602?
No — if it is appearing and installing normally. A KB2267602 entry in Windows Update every day means Microsoft is actively maintaining Defender’s threat database and your PC is receiving updates. This is the correct behavior.
Yes — if you see explicit error codes like 0x80070643, 0x8024402C, or 0x80070070 next to KB2267602 in Windows Update, or if the Security intelligence version in Windows Security has not updated in several days. These indicate a genuine installation failure that should be fixed using the steps above.
Prioritize fixing it if your PC runs in a high-security environment, processes sensitive data, or is connected to networks that may be targeted. Outdated Defender definitions leave your system without protection against threats that Microsoft has already identified and patched for everyone whose definitions are current.
The OpenAI rogue agent incident — where AI models autonomously breached Hugging Face’s systems — is a reminder that cybersecurity threats now operate at machine speed. Keeping Defender’s definitions current is one of the simplest and most effective protections available for any Windows user.
Frequently Asked Questions
What is KB2267602?
KB2267602 is the Security Intelligence Update for Microsoft Defender Antivirus. Unlike standard Windows updates, KB2267602 uses the same KB number permanently while the version inside changes constantly as Microsoft ships new threat signatures and detection logic — often multiple times per day.
Why does KB2267602 keep appearing every day?
This is normal behavior. Microsoft updates Defender’s threat database at least once daily with new malware signatures and detection rules. Each new definition version appears in Windows Update under the same KB2267602 identifier. Installing it and seeing a new version the next day means the update stream is working correctly.
What does KB2267602 error 0x80070643 mean?
Error 0x80070643 is a fatal error that usually indicates a corrupted Defender component or conflicting antivirus software. Fix it by clearing Defender definitions manually with MpCmdRun.exe -removedefinitions -dynamicsignatures, running SFC and DISM, or downloading the definition package manually from Microsoft’s security intelligence page.
How do I fix KB2267602 stuck in an endless loop?
Check Task Manager for MpSigStub.exe — if it is running, a previous definition update is still completing in the background. Wait for it to finish. If the loop persists, restart the Windows Update and Windows Defender services, then clear the Windows Update cache by renaming the SoftwareDistribution folder.
Is it safe to ignore KB2267602 failures?
Not long-term. If KB2267602 is genuinely failing — not just reappearing normally — your Defender definitions are not being updated with new threat signatures. This leaves your PC without protection against newly identified malware. Fix the underlying error as soon as you identify it.
Why does ESET keep warning me about KB2267602?
ESET monitors Windows Defender’s definition currency as part of its system health checks. When a new Defender definition version is available, ESET generates a warning that Defender is out of date. This is ESET working correctly — it will warn you again when the next Defender version ships. You can suppress these notifications in ESET’s settings or switch to using only one antivirus product.
How do I check if KB2267602 is installed correctly?
Open Windows Security, go to Virus and threat protection, and click Virus and threat protection updates. Check that the Security intelligence version shows today’s date. If it does, KB2267602 is installing correctly. You can also run Get-MpComputerStatus in PowerShell to see the exact definition version and last update timestamp.
What is the difference between KB2267602 and KB5101650?
KB5101650 is the July 2026 Patch Tuesday cumulative security update for Windows 11 — a fixed one-time package that installs once and does not reappear. KB2267602 is Microsoft Defender’s recurring definition update that ships daily under the same KB number with new version content. They update different things and behave completely differently in Windows Update.
