If you see KB5007651 in your Windows Update queue — again — you are not alone. It is one of the most frequently reported confusing update behaviors in Windows 10 and Windows 11, and the confusion is understandable because KB5007651 behaves unlike any other Windows update.
KB5007651 is the update Microsoft uses to deliver new versions of the Windows Security platform — the underlying antimalware engine that powers Microsoft Defender. Unlike cumulative Windows updates, KB5007651 ships independently through Windows Update.
This guide explains exactly what KB5007651 is, why it keeps reappearing, what every common error means, and how to fix each one — including the specific behavior on systems with third-party antivirus software.
What Is KB5007651?
KB5007651 is a Windows Security platform update tied to Microsoft Defender and the Windows Security app. It commonly appears through Windows Update because Microsoft uses it to refresh security components, improve protection features, and address reliability issues in the built-in security experience.
Specifically, KB5007651 updates two distinct components.
The Microsoft Defender antimalware platform — the engine that performs scanning, detection, and threat response. This is different from the threat signature database — it is the scanning software itself that analyzes files and behavior.
The Windows Security app — technically known as Microsoft.SecHealthUI, this is the UWP application that shows your protection status, firewall state, app and browser controls, device security information, and security alerts. KB5007651 updates this app alongside the platform components.
Unlike large monthly cumulative updates, KB5007651 is focused on the Defender platform components that help Windows Security run correctly and communicate with Microsoft Defender Antivirus. Security intelligence updates refresh malware definitions so Defender can detect newer threats. KB5007651 is different — it updates the underlying platform files and Windows Security integration layer. In practical terms, it may affect the Windows Security app interface, tamper protection behavior, and security status reporting mechanisms.
KB5007651 vs KB2267602 — An Important Distinction
Many users confuse KB5007651 with KB2267602. Both involve Microsoft Defender but they do completely different things.
| KB5007651 | KB2267602 | |
|---|---|---|
| What it updates | Defender platform engine + Windows Security app | Threat signatures and malware definitions |
| Frequency | Periodic — monthly or as needed | Daily — multiple times per day |
| KB number changes | No — same number, version increments | No — same number, version increments |
| Size | Larger — platform components | Small — signature database only |
| Appears if no Defender | No — skipped on non-Defender systems | No — same |
Think of it this way: KB2267602 tells Defender what to look for — new malware patterns, new threat signatures. KB5007651 updates how Defender looks — the scanning engine, detection logic, and the Windows Security app that reports everything to you.
Both use the same KB number permanently while their internal version numbers change. Microsoft periodically publishes new builds of KB5007651 to the Update Catalog. The version number increments with each release, but the KB article number stays the same.
Why KB5007651 Keeps Reappearing — Every Cause Explained
This is the question most users have. The update appears to install successfully, then shows up again. Or it fails to install and keeps retrying. Here is every known cause.
Cause 1 — Third-Party Antivirus Disabling Defender Components
This behavior is especially common on machines running third-party antivirus software such as Norton 360, ESET NOD32, or Bitdefender GravityZone, because those products disable parts of the Defender engine that KB5007651 tries to update.
When you install a third-party antivirus, Windows automatically disables Microsoft Defender’s real-time protection to avoid conflicts. But the Defender platform components that KB5007651 updates still exist on the system — they are just turned off. When KB5007651 tries to update those components, it completes the file replacement but cannot verify that the updated components are active, so Windows Update continues to flag it as pending.
For environments using Bitdefender GravityZone or similar endpoint protection that fully replaces the Defender engine, the KB5007651 update may perpetually cycle because the Defender AV module it targets is intentionally disabled. In these cases, you can suppress the update through your patch management tool or accept the cosmetic failure, since the underlying security platform components still get updated.
Cause 2 — Interactive Login Required to Complete Registration
There is also a confirmed quirk where the update only completes properly when a user is actively logged in.
KB5007651 updates the Windows Security app — a UWP application. UWP app updates sometimes require an active user session to complete registration. On headless systems, server environments, or PCs where updates install during scheduled maintenance when no user is logged in, KB5007651 may install its files but fail to complete the registration step. When the user logs in, Windows detects the incomplete registration and re-offers the update.
Cause 3 — Component Store Mismatch
The root cause varies depending on the version of KB5007651 being offered and your system configuration. In many cases, the update installs at the system level but fails to fully register with the Windows Security app — specifically the Microsoft.SecHealthUI component — so Windows Update continues to flag it as pending.
The Windows Security app and the underlying platform components have separate version tracking. If the platform updates but the app’s version record does not update correctly — due to a component store mismatch — Windows Update sees a discrepancy and re-offers the update.
Cause 4 — Corrupted Update Cache
A corrupted Windows Update cache causes KB5007651 to appear to download and install successfully, then disappear from the history and reappear in the queue. The corrupted cached files are being used for the installation rather than fresh downloaded files, and the installation completes incorrectly.
Cause 5 — Windows Security App Registration Failure
KB5007651 attempts to update components that are turned off — causing Windows to retry indefinitely.
If Windows Security itself is in a broken state — blank pages in the app, protection features showing as unavailable, the dashboard not loading correctly — KB5007651 may loop because the components it is trying to register are in an inconsistent state that prevents successful registration even after the files are replaced.
Every Fix — In Order of What to Try First
Fix 1 — Restart and Check Again
Before troubleshooting, restart your PC and check Windows Update again. Just received this update this morning via WU. Install says fine — no reboot necessary. Will reboot and see if anything changes. EDIT — Rebooted system and was not offered update a second time.
For many users, KB5007651 installs on the first attempt and does not reappear after a restart. If it disappears after restarting, no further action is needed.
Fix 2 — Verify Whether KB5007651 Is Actually Installed
Before resetting Windows Update or repairing Windows Security, verify whether KB5007651 is genuinely missing or whether Windows is repeatedly offering an update that is already installed.
Method 1 — Windows Security app
Open the Windows Security app, click the gear icon to access Settings, and select About. The version of the Windows Security service is listed there. You can compare this number against the version offered in Windows Update to determine whether the latest KB5007651 revision has been applied.
Method 2 — PowerShell
Open PowerShell as administrator and run:
powershell
Get-AppxPackage Microsoft.SecHealthUI | Select Name, VersionThis returns the installed version of the Windows Security app. If the version matches what Windows Update is offering, the update is already applied and the reappearance is a display issue rather than a genuine failure.
Method 3 — Windows Update History
Go to Settings, Windows Update, Update History. Look for KB5007651 with a Successfully installed status.
Fix 3 — Run Windows Update Troubleshooter
Go to Settings, System, Troubleshoot, Other troubleshooters. Run Windows Update. The troubleshooter checks for common registration failures, service issues, and cache problems that cause KB5007651 to cycle repeatedly. Apply any suggested fixes and restart before checking Windows Update again.
Fix 4 — Reset Windows Security App via PowerShell
If the Windows Security app itself is in a broken state, resetting it forces a clean registration of the Microsoft.SecHealthUI component.
Open PowerShell as administrator and run:
powershell
Get-AppxPackage Microsoft.SecHealthUI -AllUsers | Reset-AppxPackageAfter the reset completes, restart your PC and try installing KB5007651 again through Windows Update.
Fix 5 — Re-register the Windows Security App
If the reset does not resolve the issue, re-registering the app addresses component mismatch errors.
Open PowerShell as administrator and run:
powershell
Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"Then restart and retry Windows Update.
Fix 6 — Clear the Windows Update Cache
A corrupted Software Distribution folder prevents KB5007651 from downloading and installing fresh files.
Open Command Prompt as administrator and run:
net stop wuauserv
net stop bits
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
net start bits
net start wuauservRestart and check Windows Update again. Windows re-downloads a fresh copy of KB5007651 instead of using corrupted cached files.
Fix 7 — Run SFC and DISM
Corrupted Windows system files can prevent KB5007651’s platform components from registering correctly.
Open Command Prompt as administrator and run:
sfc /scannowWait for it to complete. Then run:
DISM /Online /Cleanup-Image /RestoreHealthRestart after both scans complete and retry Windows Update.
Fix 8 — Restart Windows Defender-Related Services
If Defender services are in a stuck state, KB5007651 cannot complete its registration.
Open Command Prompt as administrator and run:
net stop WinDefend
net stop SecurityHealthService
net start SecurityHealthService
net start WinDefendRestart and check Windows Update.
Fix 9 — Accept the Loop If Using Third-Party Antivirus
If you are running Norton, ESET, Bitdefender, Kaspersky, or any other third-party antivirus that disables Microsoft Defender’s real-time protection, KB5007651 may loop indefinitely. This is a cosmetic issue — not a security problem.
In these cases, you can suppress the update through your patch management tool or accept the cosmetic failure, since the underlying security platform components still get updated.
Your protection is being provided by the third-party antivirus. The Windows Security platform components get updated even if the registration verification loop continues. You can either accept the ongoing loop or exclude KB5007651 from your patch management tooling.
Fix 10 — Check for the LSA Protection Registry Issue
A lesser-known issue: after some KB5007651 versions, Windows Security falsely reports LSA Protection as disabled due to missing registry entries under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa.
If Windows Security is showing an LSA Protection warning that does not clear even after enabling the toggle and rebooting, check whether the relevant registry keys are present.
Open Registry Editor (Win + R, type regedit). Navigate to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LsaLook for the RunAsPPL value. If it is missing or set to 0, this is the source of the false warning. Set it to 1 (DWORD) and restart. This issue was confirmed by Microsoft and addressed in later KB5007651 revisions — installing the latest version of the update through Windows Update resolves it without manual registry editing on most systems.
Common Error Codes With KB5007651
0x80070643 — Fatal error during installation. Most commonly occurs when Defender services are in a stuck state. Use Fix 8 (restart Defender services) then retry.
0x800705B4 — This operation returned because the timeout period expired. Usually a temporary service issue. Wait 30 minutes and retry Windows Update.
0x80070002 — File not found. The update package references a file that is missing or corrupted. Use Fix 6 (clear cache) and Fix 7 (SFC/DISM) to restore the missing file before retrying.
0x80073D02 — The package could not be registered because it is currently in use. Close all Windows Security windows and any apps that use Windows Security APIs before retrying. If the error persists, use Fix 5 (re-register the app) after a restart.
If you are encountering error 0x80244022 when trying to download KB5007651, that is a connection error rather than an installation error — our full fix guide covers every solution for that specific code.
How KB5007651 Connects to July 2026’s Windows Updates
The July 2026 update cycle that delivered KB5101650 — the record 570-vulnerability Patch Tuesday — also saw KB5007651 appear alongside the main update on many systems.
Users who installed KB5101650 and then saw KB5007651 in their update queue were seeing the normal behavior: Microsoft released a new platform version alongside the month’s cumulative security update. The two updates address different components and install independently.
The KB2267602 daily Defender definition update runs on top of the platform that KB5007651 maintains. Keeping both current gives you the best protection: a current platform engine via KB5007651 and current threat signatures via KB2267602.
Frequently Asked Questions
What is KB5007651?
KB5007651 is the Windows Security Platform update — a Microsoft update that refreshes the underlying Microsoft Defender antimalware engine and the Windows Security app. Unlike cumulative OS updates or daily definition updates, it specifically updates the platform components that make Defender work and the app that displays your security status.
Is KB5007651 safe to install?
Yes. It is a legitimate Microsoft update delivered through Windows Update. It improves the security platform that protects your PC. The update occasionally has installation quirks — particularly with third-party antivirus software — but the update itself is safe and beneficial.
Why does KB5007651 keep reinstalling?
The most common causes are third-party antivirus software that disables Defender components, a component mismatch between the Windows Security app and the platform files, a need for an active user login to complete registration, or a corrupted update cache. Use the diagnostics and fixes in this guide to identify which cause applies to your system.
Is KB5007651 the same as KB2267602?
No. KB2267602 is Microsoft Defender’s daily security intelligence update — it refreshes threat signatures and malware definitions. KB5007651 updates the Defender platform engine and Windows Security app. Both use permanent KB numbers with incrementing version numbers, but they update different components on different schedules.
Does KB5007651 cause any problems?
Most installations are uneventful. Historically, some versions caused a false LSA Protection warning in Windows Security due to missing registry entries — Microsoft acknowledged this and issued revised versions. The most common current issue is the update cycling on systems with third-party antivirus software, which is a cosmetic issue rather than a functional problem.
Do I need KB5007651 if I use a third-party antivirus?
The update can cycle indefinitely on systems where third-party antivirus has disabled Defender’s real-time protection. You can accept this behavior — the underlying components still update even if Windows cannot verify the registration — or suppress the update through your patch management tool. Your protection is provided by the third-party antivirus regardless.
How do I check which version of KB5007651 is installed?
Open the Windows Security app, go to Settings, and select About. The version number shown is the current installed version of the Windows Security platform. You can also run Get-AppxPackage Microsoft.SecHealthUI in PowerShell to see the version.
Can KB5007651 cause an update loop?
Yes — the update loop is the most frequently reported KB5007651 behavior. It occurs when Windows installs the update but cannot complete verification of the installation, causing it to reappear as available. The fixes in this guide — particularly resetting the Windows Security app via PowerShell and clearing the update cache — resolve most loop scenarios.
This supports that KB5007651 is not needed as a separately installed hotfix on your Windows 11 25H2 system. Its Security app/Defender-related functionality has been superseded by newer Windows Security and Defender platform packages. Since you use ESET as the primary antivirus, the remaining useful check is Defender’s operating mode and whether Windows recognizes ESET correctly: Get-MpComputerStatus | Select-Object AMRunningMode, AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled, IsTamperProtected Expected outcome: Defender may show Passive Mode and reduced or disabled real-time protection while ESET provides active antivirus protection.