Microsoft Defender AV must be configured to check for definition updates daily.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-213454 | WNDF-AV-000030 | SV-213454r961161_rule | CCI-001308 | medium |
| Description | ||||
| This policy setting allows specifying the day of the week on which to check for definition updates. The check can also be configured to run every day or to never run at all. This setting can be configured with the following ordinal number values: (0x0) Every Day (default) (0x1) Sunday (0x2) Monday (0x3) Tuesday (0x4) Wednesday (0x5) Thursday (0x6) Friday (0x7) Saturday (0x8) Never If this setting is enabled, the check for definition updates will occur at the frequency specified. If this setting is disabled or not configured, the check for definition updates will occur at a default frequency. | ||||
| STIG | Date | |||
| Microsoft Defender Antivirus Security Technical Implementation Guide | 2026-05-08 | |||
Related Frameworks
1 mapping across 3 frameworks
Related Frameworks
SCF0 mappings
No source states a mapping between these directly.
Also reachable in 3 hops (1) derived by us, not asserted by any source
Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.
- DISA STIG Benchmark (XCCDF)V2R9intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- SCF Secure Traceability Relationship Mapping (STRM)2026.2equal to
NIST 800-530 mappings
No source states a mapping between these directly.
Also reachable in 2 hops (1) derived by us, not asserted by any source
Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.
- DISA STIG Benchmark (XCCDF)V2R9intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
CCI1 mapping
CCI-001308
1.00
- DISA STIG Benchmark (XCCDF)V2R9intersects(normalised)
Details
Check Text (C-213454r961161_chk)
Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Security Intelligence Updates >> "Specify the day of the week to check for security intelligence updates" is set to "Enabled" and "Every Day" is selected in the drop-down box.
Procedure: Use the Windows Registry Editor to navigate to the following key:
HKLM\Software\Policies\Microsoft\Windows Defender\Signature Updates
Criteria: If the value "ScheduleDay" is REG_DWORD = 0, this is not a finding.
Fix Text (F-14677r823076_fix)
Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Signature Updates >> "Specify the day of the week to check for definition updates" to "Enabled" and select "Every Day" in the drop-down box.