Docs
KB4052623 Explained: Microsoft Defender Antivirus Platform Update Guide
Understand what KB4052623 is, why the same KB number keeps appearing, how Defender platform updates differ from KB2267602, and where to download or troubleshoot the update.
Question for Windows admins and users troubleshooting Microsoft Defender Antivirus platform update behavior
KB4052623 is the Microsoft Defender Antivirus antimalware platform update. It is easy to confuse with KB2267602 because both can appear repeatedly in Windows Update history, but they update different parts of Defender.
KB4052623 updates the Defender platform components, servicing code, and client-side runtime pieces. Microsoft describes Defender platform updates as monthly, while KB2267602 security intelligence can update much more frequently. Use this page to tell the two apart, find the right download path, and troubleshoot failures without chasing the wrong update family.
What You'll Get
- Understand what KB4052623 updates and why the KB number repeats
- Separate Defender platform updates from security intelligence updates
- Use the right Microsoft download, release note, and troubleshooting path
Jump To
Short Answer
KB4052623 is the recurring Microsoft Defender Antivirus antimalware platform update. It updates Defender platform components, not the daily security intelligence definitions. The KB number stays the same while the platform version changes over time.
Microsoft says Defender Antivirus requires monthly platform updates known as KB4052623. If you are looking at a repeated Defender update in Windows Update history, the key question is whether the version is advancing. A newer platform version under the same KB is usually normal. The same version failing repeatedly is a real troubleshooting signal.
Sources: Microsoft Learn: Defender Antivirus updates, Microsoft Learn: manage protection updates
KB family ID
KB4052623
The label for Defender Antivirus platform updates.
Update type
Platform
Runtime, servicing, and product platform components.
Typical cadence
Monthly
Microsoft describes Defender platform updates as monthly.
Do not confuse with
KB2267602
KB2267602 is security intelligence, not the platform update.
What KB4052623 Actually Updates
KB4052623 updates the Microsoft Defender Antivirus antimalware platform. The platform is the product layer that Defender runs on: service components, platform binaries, update plumbing, and related client behavior. It is different from the malware definitions that tell Defender what threats to detect.
| Update family | What changes | Typical cadence | Common search phrase |
|---|---|---|---|
| KB4052623 | Defender Antivirus platform components | Monthly | update for Microsoft Defender Antivirus antimalware platform - KB4052623 |
| Engine update | Scanning engine internals | Monthly | Microsoft Defender engine version |
| KB2267602 | Security intelligence, definitions, and detection content | Multiple times a day | security intelligence update for Microsoft Defender Antivirus |
This distinction matters because a device can have fresh KB2267602 definitions while still being behind on the Defender platform. If your issue is stale definitions, use the KB2267602 guide. If your issue is the Defender platform version, platform folder, or updateplatform.exe, stay on this page.
Why KB4052623 Keeps Showing Up
KB4052623 keeps the same KB family name across platform versions. Windows Update, WSUS, Configuration Manager, and patch tools may show it repeatedly as Microsoft releases newer Defender platform builds.
That repeated appearance is not automatically a failure. Treat it as normal when the platform version advances. Investigate when the same version fails, the Defender platform remains old, Windows Security breaks, or managed devices stop receiving the monthly platform update.
KB4052623 vs KB2267602
Admins often mix these two because both carry Defender branding and both can repeat in update history. They are different operating concerns.
| Question | KB4052623 | KB2267602 |
|---|---|---|
| What does it update? | Defender Antivirus platform components | Security intelligence and threat definitions |
| How often? | About monthly, according to Microsoft platform-update guidance | Frequently, often multiple times per day |
| Where do I verify locally? | AMProductVersion and platform folder/version signals | AntivirusSignatureVersion and signature timestamp |
| Common manual package | updateplatform.exe | mpam-fe.exe or signature update commands |
| Best related guide | This page | KB2267602 explained |
Current Version and Release Notes
Do not copy an old KB4052623 version number from a forum post, screenshot, or stale patch list. Microsoft publishes Defender Antivirus platform, engine, and update support information in Microsoft Learn, while Microsoft Update Catalog exposes the current downloadable KB4052623 package.
On an endpoint, start with:
Get-MpComputerStatus | Select-Object AMProductVersion, AMEngineVersion, AntivirusSignatureVersion, AntivirusSignatureLastUpdated
You can also inspect the Defender platform folder when you are troubleshooting broken or missing platform components:
Get-ChildItem "C:\ProgramData\Microsoft\Windows Defender\Platform" -Directory
If the endpoint is not clearly running Defender as the active antivirus engine, verify that first with the Defender status guide.
KB4052623 Download and Offline Update Paths
For normal endpoints, the preferred path is still automatic updating through Windows Update, Microsoft Update, or your managed update source. Use manual or offline workflows only when the normal path is broken or when you intentionally maintain disconnected update media.
Microsoft Learn documents a UNC-share style platform update workflow where KB4052623 is downloaded and copied into architecture folders as updateplatform.exe. It also notes those files are updated monthly and must be manually replaced each month.
| Need | Best path | Watch out for |
|---|---|---|
| One normal Windows client | Windows Update or Microsoft Update | Do not chase manual packages unless automatic update fails. |
| Offline or controlled platform update | Microsoft Update Catalog package / updateplatform.exe | Replace monthly and use the right architecture. |
| Managed fleet | WSUS, Configuration Manager, Intune, or configured update source order | Make sure platform updates are included, not only security intelligence. |
| Windows Server 2016 or 2019 issue | Confirm Defender role/features, platform baseline, and Microsoft Update availability | Server behavior can differ from Windows client expectations. |
Common KB4052623 Problems and What They Usually Mean
| Symptom | Likely meaning | Recommended next step |
|---|---|---|
| KB4052623 installs repeatedly with newer platform versions | Usually normal monthly platform update behavior | Confirm the platform version advances. |
| KB4052623 failed | Platform package, update source, service health, or policy issue | Check Windows Update history, Defender service state, and managed update policy. |
| KB4052623 download or offline download is needed | Automatic update path is unavailable or a disconnected workflow is being used | Use Microsoft Update Catalog and follow the updateplatform.exe guidance. |
| KB4052623 on Server 2016 or Server 2019 does not behave like a client | Server Defender configuration, role state, or update source may differ | Verify Defender is installed, active, and allowed to receive Microsoft product updates. |
| Security intelligence updates work but platform remains old | Your update process may include KB2267602 but not KB4052623 | Review WSUS, Configuration Manager, Intune, or third-party patch classifications. |
| Windows Security breaks after a platform update | Broader Defender platform or Windows Security app issue | Validate AMProductVersion, service health, and recent update history before rolling changes across more devices. |
How to Troubleshoot KB4052623 on One Device
Start by proving which Defender layer is stale or broken.
- Check Defender status with
Get-MpComputerStatus. - Compare
AMProductVersion,AMEngineVersion, andAntivirusSignatureVersion. - Open Windows Update history and confirm whether the failing item is KB4052623 or KB2267602.
- Confirm the device can receive updates for Microsoft products, not only Windows OS updates.
- If managed, check whether the policy or patch tool includes Defender platform updates.
- If offline, download the current KB4052623 package from Microsoft Update Catalog and use the correct architecture package.
If only signatures are stale, switch to the Defender update-status guide. If Defender is not active at all, switch to the Defender status guide before troubleshooting platform updates.
How to Handle KB4052623 in Managed Environments
Managed environments need to make sure KB4052623 platform updates are part of the update workflow. It is common to focus on security intelligence updates and miss the platform layer.
- WSUS: confirm Defender platform updates are synchronized and approved, not only security intelligence.
- Configuration Manager: confirm software update rules include the Defender platform update family.
- Intune or policy-managed devices: confirm the update source order allows platform updates to arrive from the intended source.
- Offline shares: replace
updateplatform.exemonthly and keep architecture folders current. - Third-party patch tools: confirm they ingest KB4052623 platform packages, not only Windows cumulative updates and KB2267602 definitions.
The operating metric is not simply whether KB4052623 appeared. It is whether endpoints are on a supported Defender platform version and still receiving security intelligence updates afterward.
Should You Ignore, Hide, or Remove KB4052623
In most cases, no. Do not hide KB4052623 just because it appears repeatedly. A new platform version under the same KB number is expected behavior.
Investigate when:
- the same platform version fails repeatedly
- Defender platform folders are missing or stale
- Windows Security reports broken protection after the update
- managed endpoints receive KB2267602 definitions but never receive platform updates
- Windows Server endpoints cannot install or advance the Defender platform
For fleet operations, track Defender platform version alongside signature freshness. The platform tells you whether Defender itself is current enough to run correctly; signatures tell you whether the detection content is fresh.
Sources
- Microsoft Learn: Microsoft Defender Antivirus security intelligence and product updates
- Microsoft Learn: manage how and where Defender Antivirus receives updates
- Microsoft Learn: troubleshoot security intelligence not getting updated
- Microsoft Update Catalog: KB4052623 search
- Microsoft Security Intelligence updates for Microsoft Defender Antivirus