Direct answer
Verify the installed security intelligence version and update time, compare them with the organization's update policy and investigate the configured source, connectivity and errors before retrying.
Record the observed state
On the affected device or in its management console, record the product mode, intelligence version, last successful update and device reporting time. An old management report may not reflect a current device, while a recently reported version may still be stale relative to policy.
Trace the update path
Identify whether the device uses Windows Update, an internal source or another configured update path. Microsoft documents multiple protection-update sources and fallback behavior. Check network access, source health, error codes and whether the device is online before changing policy.
Reference: Microsoft: Manage Defender protection updates.
Restore and verify
Follow the approved update procedure and capture the resulting version and time. Compare multiple affected devices to distinguish an individual fault from a source outage. Confirm normal management check-in and retain an owner and review date for devices still offline.
Separate a source outage from one device
If several laptops last updated on the same day, compare their configured update source, connectivity and error timestamps. A shared source problem needs a different owner than one laptop that has been offline for weeks. Verify a fresh version on representative devices after repair and keep the rest in the remediation queue until they report.
Assessment limits
A current intelligence version does not guarantee malware detection or prove the device is uncompromised. Alternative antivirus providers have their own update paths.
Frequently asked questions
Is an old console timestamp always a stale signature?
No. It may indicate delayed device reporting; verify the local and management timestamps separately.
Does an updated signature prove antivirus is active?
No. Confirm the intended provider and protection mode as well.
Should update errors be ignored on offline devices?
Track them explicitly and verify protection once the devices reconnect.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.