Update history won't stay blank

From time to time I run this script to clear update history when it gets too crowded. Normally, the script would run and after wuauserv and mousocoreworker get back to work again, system looks for updates, finds nothing new and the Update history shows "No installed updates" (until the next Windows Defender definition comes up ofc )

Recently, after running the script and services come back Windows Update starts "downloading" and update called "Windows Intelligence Update". Thing is, if I run the cleaning script, it shows up AGAIN downloading and installing. Also, there is no information about this update anywhere.

This "update" leaves zero traces at the Event viewer and no new files show up at SoftwareDistribution/Download.

Tried doing a clean install with official ISO and another clean install with an uupdump made iso and it keeps happening. Any work around?

Unless you disable Defender, WU history will show all Defender signature and platform updates as they're downloaded.

There's no point in clearing the Updates history, it's a running tally of recent events. Whenever there's too many entries, the oldest events disappear. The list doesn't scroll back to when your copy of Windows was installed.

garlin said:

Unless you disable Defender, WU history will show all Defender signature and platform updates as they're downloaded.

There's no point in clearing the Updates history, it's a running tally of recent events. Whenever there's too many entries, the oldest events disappear. The list doesn't scroll back to when your copy of Windows was installed.

Click to expand...

Never expected history to remain blank forever, even mentioned definition updates showing quickly was the usual correct behavior.

I am talking about a ghost update (Windows Intelligence Update) which keeps coming back. No event log entry, no files. Just shows in recently cleared update history.

Why is that considered a "ghost update?" Defender has two kinds of updates:

• Intelligence Updates or definitions (signatures for file scanning)
• Platform updates (Defender engine)

Definitions are pushed out every day (and sometimes 2-3 times in day), and platform updates about once a month but it's not a fixed schedule.
Malicious Software Removal Tool every month, but it keeps the same KB number even though it's a newer version.

MS has an automated process to detect new malware in the wild, and push out definitions to block it ASAP. If you're using Defender, and not receiving daily updates -- that would be bad.

garlin said:

Why is that considered a "ghost update?" Defender has two kinds of updates:

Click to expand...

Every real update (be it from Windows Update or Microsoft Store) leaves traces at the Event log, one event when it starts downloading and one when it installs. This one doesn't. Nothing new appears at the SoftwareDistribution folder either.

"Windows intelligence update" is neither a definition nor a platform update. It's listed as "Other updates" and has no version number.

If the system is up to date and history is cleared it should show there are no updates installed. Instead, this "update" is triggered.

Maybe your platform or definitions are corrupted? Run these commands as Administrator:

Finally run this script adapted from this Stack Overflow question, to check if WU recognizes everything.

garlin said:

Maybe your platform or definitions are corrupted? Run these commands as Administrator:

Code:

"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -removedefinitions -dynamicsignatures
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -SignatureUpdate
powershell Update-MpSignature

Finally run this script adapted from this Stack Overflow question, to check if WU recognizes everything.

Code:

powershell -nop -ep bypass -f Get-WUAHistory.ps1

Click to expand...

Hi
Ran all the commands as Admin. The first three went without errors.

WUAHistory.ps1 output:
Result Date Title
------ ---- -----
Succeeded 5/9/2023 10:23:25 PM 9MSMLRH6LZF3-Microsoft.WindowsNotepad
Succeeded 5/9/2023 10:10:45 PM Update for Windows Security antimalware platform - KB5007651 (...

Windows Update History as seen from Settings shows the platform update AND also:
Other updates (1)
Windows Intelligence Update (2)

When I test the clear history script again, now WUAHistory.ps1 shows nothing but the Settings app shows the Windows Intelligence Update. I'm starting to think this is a bug in the Settings app