Automatic Sample Submission is Off?

Dru2 · Jul 22, 2021

plat said:
OK, thanks Dru2--so it seems you're one version behind on the Engine, but notice that the Antimalware Client Version is the same and Bree's is one behind. So, maybe that updated Client version contained the fix? This is such speculation but it really is baffling, esp. how I got one version ahead on the Engine.

Same client: 4.18.2107.4

Yeah, I can't explain any of this, not even going to try. I just know the two machines Windows 11 is installed on, the issue is gone. I also notice Microsoft states in their latest KB5004300 release that the issue is still there so...

BTW, I DO need to mention this issue actually appeared on my Windows 10 Education OS (21H1), but didn't pay much attention to it being I knew I was going to update to 11. However, I wasn't really surprised it was still there until I saw it also appeared on my laptop. Thus my initial post.

Thanks.

Bree · Jul 22, 2021

plat said:
OK, thanks Dru2--so it seems you're one version behind on the Engine ... and Bree's is one behind. So, maybe that updated Client version contained the fix? This is such speculation but it really is baffling, esp. how I got one version ahead on the Engine.

I have two W11 machines, both listed in My Computers below. The other is a VM, and I've just run it up to get its .100 CU. That one does have the 1.1.18400.4 engine and the 4.18.2107.4 client, even before I installed this CU. I have no idea how or when it got them, as there are no records of an update to be found in Update History, Reliability History, or Installed Updates in Control Panel.

Oh, and Automatic Submission remains turned on after a Restart for that machine.

Ed Tittel · Jul 23, 2021

I can't get to 4.18.2107.4 for love nor money. Still stuck on 4.18.2106.6. Sigh.
--Ed--

maurice naggar · Jul 23, 2021

Hi Ed. As you likely know, there are many different ways to try to get the latest Windefend.
In a Elevated Powershell, Copy >> Paste this into the Powershell window

Code:

Update-MpSignature

plat · Jul 24, 2021

Fix is still in effect--groovy.

Is it possible to force this update to the Antimalware platform? It now seems this is more a silent update to a platform component Microsoft is issuing in stages and evaluating via Telemetry. At least that's my inference as there's been no universal fix yet--just random users like me saying "Oh look, it's gone. Phew!"

When I force updates to Defender, a universal update to the Platform is always displayed in addition to any definitions. Then it's logged in Settings/Windows Update/Update History/Definition Updates. Nothing in there about a recent Platform update. Not yet.

Almighty1 · Jul 24, 2021

maurice naggar said:
Hi Ed. As you likely know, there are many different ways to try to get the latest Windefend.
In a Elevated Powershell, Copy >> Paste this into the Powershell window

Code:

Update-MpSignature

Just done that... it's the Engine that still didn't get updated.

maurice naggar · Jul 24, 2021

It 'may' be that there is some sort of 'metered' release. Perhaps some of you can run a manual pull for update at the TOP of the clock hour.

Bree · Jul 24, 2021

maurice naggar said:
Hi Ed. As you likely know, there are many different ways to try to get the latest Windefend.
In a Elevated Powershell, Copy >> Paste this into the Powershell window

Code:

Update-MpSignature

Almighty1 said:
Just done that... it's the Engine that still didn't get updated.

@Ed Tittel

The engine and the client are only updated by the Antimalware Client package. This is normally only available through Windows Update and, as has been my experience in the past with W10, at the whim of MS when they feel like it - my W10 machines have typically got their updates weeks apart. There is a manual download available though...

New version: 1.1.2107.02

This package updates the anti-malware client, anti-malware engine, and signature versions in the OS installation images...

Microsoft Defender update for Windows operating system installation images - Microsoft Support

Describes a Windows Defender update package for Windows Server 2019, Windows Server 2016, and Windows 10.

support.microsoft.com

...but although MS says there is a new version 1.1.2107.02, the download links on that page still download a package with a .cab file containing the 4.18.2105.5 Client and the 1.1.18300.4 engine.

maurice naggar · Jul 25, 2021

As concerns enabling automatic sample submission, applying this pair of Powershell cmdlets should take care if that.

Code:

Set-MpPreference -MAPSReporting Advanced
Set-MpPreference -SubmitSamplesConsent SendAllSamples

TairikuOkami · Jul 25, 2021

maurice naggar said:
As concerns enabling automatic sample submission, applying this pair of Powershell cmdlets should take care if that.

Not very privacy friendly setup though (better to use the default), Kaspersky was banned in USA because of that. :nope:

Code:

Set-MpPreference -MAPSReporting Basic
Set-MpPreference -SubmitSamplesConsent SendSafeSamples

Bree · Jul 27, 2021

I've just done an in-place upgrade from W10 to W11. Automatic sample submission remains turned on after a Restart. It has the Antimalware Client version 4.18.2107.4 - so that seems to be the key to fixing this issue.

johnlgalt · Jul 27, 2021

I did an in-place upgrade from 10 to 11 and it did not.

I also tried the PS commands and it did not.

I wonder if it is the cumulative updates that break it? IIRC, when I first installed the leak it happened almost immediately. When I then reverted to 10 and upgraded to 11, it didn't happen for a while, and then started happening.

Every update since it's been happening within a few reboots of the update.

Bree · Jul 27, 2021

johnlgalt said:
I did an in-place upgrade from 10 to 11 and it did not.

When I did mine I let it check for updates during the upgrade, perhaps that's why I got the newer antimalware client?

johnlgalt · Jul 27, 2021

I used Windows Update to update from 19043.1081 to 22000.51, and and every iteration since - 51 --> 65, 65 --> 71, and 71 --> 100

Bree · Jul 27, 2021

johnlgalt said:
I used Windows Update to update from 19043.1081 to 22000.51, and and every iteration since - 51 --> 65, 65 --> 71, and 71 --> 100

I used an ISO of 22000.71 (from UUPDump) to do an in-place upgrade (actually a repair upgrade on a system already running W11). I accepted the default setting of letting it check for update while installing. When all done I had the newer antimalware client.

johnlgalt · Jul 27, 2021

Interesting. because my AV and AS clients are newer while my AM version is older.

Just had some bad storms roll through here, so I was off for a while, but I can try an in-place upgrade using the ,100 disc I made and see what happens.....

Almighty1 · Jul 28, 2021

johnlgalt said:
Interesting. because my AV and AS clients are newer while my AM version is older.

View attachment 4229

Just had some bad storms roll through here, so I was off for a while, but I can try an in-place upgrade using the ,100 disc I made and see what happens.....

The first two known is only updated once a month when I googled it a few days ago as shown here is the actual program itself:

Microsoft Defender Antivirus security intelligence and product updates - Microsoft Defender for Endpoint

Manage how Microsoft Defender Antivirus receives protection and product updates.

docs.microsoft.com

The last two which is the virus definitions database is updated from 0 to multiple times daily, you can tell from your Windows Update, Update history as basically earlier today, I did a in-place repair install with 22000.100 using the UUPdump ISO with all the updates as part of the ISO and I did allow updates when installing.

This link actually shows the latest version numbers for everything:

Latest security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware - Microsoft Security Intelligence

which as of the time of this writing shows:

The latest security intelligence update is:

Version: 1.343.1773.0
Engine Version: 1.1.18300.4
Platform Version: 4.18.2106.6
Released: 7/27/2021 7:04:07 PM

So it would seem like everyone has a newer Platform version than what is shown.

Bree · Jul 28, 2021

Almighty1 said:
So it would seem like everyone has a newer Platform version than what is shown.

That's not really surprising, we are after all running a Dev build (whether we are Insiders or not). It's reasonable to expect that the newer platform versions would get tested on the Insider rings before any public release.

The only real surprise to me is that we aren't all running the newer platform.

johnlgalt · Jul 28, 2021

Bree said:
I used an ISO of 22000.71 (from UUPDump) to do an in-place upgrade (actually a repair upgrade on a system already running W11). I accepted the default setting of letting it check for update while installing. When all done I had the newer antimalware client.

So, uh, I tried to perform an in-place upgrde, using hte 22000.100 EN-US AIO .iso that I made.

And I got this.

TWICE.

Gave up on that idea.

Almighty1 said:
The first two known is only updated once a month when I googled it a few days ago as shown here is the actual program itself:

Microsoft Defender Antivirus security intelligence and product updates - Microsoft Defender for Endpoint

Manage how Microsoft Defender Antivirus receives protection and product updates.

docs.microsoft.com

The last two which is the virus definitions database is updated from 0 to multiple times daily, you can tell from your Windows Update, Update history as basically earlier today, I did a in-place repair install with 22000.100 using the UUPdump ISO with all the updates as part of the ISO and I did allow updates when installing.

This link actually shows the latest version numbers for everything:

Latest security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware - Microsoft Security Intelligence

which as of the time of this writing shows:

The latest security intelligence update is:

Version: 1.343.1773.0

Engine Version: 1.1.18300.4

Platform Version: 4.18.2106.6

Released: 7/27/2021 7:04:07 PM

So it would seem like everyone has a newer Platform version than what is shown.

So, I used the script to try to load newer definitions, but it refuses to budge from 1769.

And I tried to download the WIndows 10 x64 installer, and nothing happens when it is run. File is mpfam-fe.exe, with a size of about 111 MB.

I don't reboot my machine all that much, so I'll just stick with having to enable it every time I do actually reboot.

Bree said:
That's not really surprising, we are after all running a Dev build (whether we are Insiders or not). It's reasonable to expect that the newer platform versions would get tested on the Insider rings before any public release.

The only real surprise to me is that we aren't all running the newer platform.

Exactly. Unless this is one of those A/B tests, although that would make 0 sense as they have it published as the latest version for all.