Microsoft's New Defender Update for Windows Install Images: Does Your USB Stick Need It?

Microsoft has refreshed its Defender update for Windows install images. It patches the antivirus files inside the image you install Windows from, so a brand-new PC isn't running months-old protection on day one.

The short answer: most home users don't need the kit. Make your USB stick from a fresh Windows ISO with Rufus, then update Defender right after setup. The kit is mainly for IT pros who reuse the same install image on lots of PCs.

What Microsoft Released

The package is called "Microsoft Defender update for Windows operating system installation images". Microsoft's support page shows the newest build, dated 20 October 2026:

• Platform: 4.18.26090.9
• Engine: 1.1.26090.9
• Security intelligence: 1.459.387.0
• Works on: Windows 11, Windows 10 (ESU and LTSC/LTSB editions) and Windows Server 2016, 2019 and 2022, for 64-bit, 32-bit and ARM64

Why Old Install Media Is a Problem

A Windows ISO is a snapshot. If you made your USB stick six months ago, the Defender antivirus inside it is six months old as well.

Microsoft says it plainly: "The first hours of a newly installed Windows deployment can leave the system vulnerable." The PC is "inadequately protected" until Defender downloads its first update.

What Home Users Should Do

1. Use a fresh ISO. Rufus can download the latest official Windows ISO for you, so you don't start from an old one.
2. Update Defender first. After setup, open Windows Security > Virus & threat protection > Protection updates and click Check for updates.
3. Run Windows Update. Go to Settings > Windows Update before you install other apps or open old files.

Installing on an older PC? Our Rufus guide for unsupported PCs covers the whole process.

For IT Pros: How to Apply the Kit

Download the kit for your architecture from Microsoft's page and unzip it. You get a CAB file and a PowerShell script called DefenderUpdateWinImage.ps1.

1. Back up the image first. The kit works on WIM and VHD files, such as the install.wim inside a Windows ISO.
2. Find the edition index with Dism /get-imageinfo /imagefile:<path>.
3. Open PowerShell as administrator and run the script with -Action AddUpdate, the image path and the index. -Action ShowUpdate checks the result.

Microsoft refreshes the package every month or two, and recommends servicing your images at least every three months.

Quick questions