Update Windows Defender Signatures from the Command Line (MpCmdRun)
Trigger an immediate Microsoft Defender antivirus definition update without opening the Security app.
01Command
$ & "$env:ProgramFiles\Windows Defender\MpCmdRun.exe" -SignatureUpdate02What it does
MpCmdRun.exe is Defender's built-in command-line tool, and -SignatureUpdate pulls the latest security intelligence definitions from Microsoft Update right away. This is useful when the Security app shows outdated definitions, when you are scripting health checks, or after restoring network access on an offline machine. If your PC cannot reach Microsoft's servers, the UNC variant (-SignatureUpdateUNC \\server\share) can pull updates from a network share instead.
03Risk
04Undo
✓No undo needed — this command does not change persistent state.
05Sources
- Configure and manage Microsoft Defender Antivirus with the mpcmdrun.exe command-line toolEvidence: Documents MpCmdRun.exe -SignatureUpdate, which triggers a security intelligence (definition) update, and related -SignatureUpdateUNC/-MMPC variants.
Last verified: 2026-09-18 · Category: Security & Privacy
06Related solutions
Built-in Windows command to compute MD5, SHA1 or SHA-256 hashes of any file.
Understand PowerShell's execution policy scopes and set the one that lets you run your own local scripts without gutting the security model.
One command that shows OS version, install date, boot time, memory, network adapters and installed hotfixes.