Select the channel for Microsoft Defender monthly engine updates
Verified with Windows 11 25H2 — updated on July 12, 2026
Supported on: At least Windows Server 2016, Windows 10 Version 1607
Path in the GPO console
Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Antivirus Description
Enable this policy to specify when devices receive Microsoft Defender engine updates during the monthly gradual rollout. Beta Channel: Devices set to this channel will be the first to receive new updates. Select Beta Channel to participate in identifying and reporting issues to Microsoft. Devices in the Windows Insider Program are subscribed to this channel by default. For use in (manual) test environments only and a limited number of devices. Current Channel (Preview): Devices set to this channel will be offered updates earliest during the monthly gradual release cycle. Suggested for pre-production/validation environments. Current Channel (Staged): Devices will be offered updates after the monthly gradual release cycle. Suggested to apply to a small, representative part of your production population (~10%). Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%). Critical - Time delay: Devices will be offered updates with a 48-hour delay. Suggested for critical environments only. If you disable or do not configure this policy, the device will stay up to date automatically during the gradual release cycle. Suitable for most devices.
Registry
Software\Policies\Microsoft\Windows Defender Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Select the channel for Microsoft Defender monthly engine updates
; State: Enabled
; Supported on: At least Windows Server 2016, Windows 10 Version 1607
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender]
"EngineRing"=dword:00000002More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Select the channel for Microsoft Defender monthly engine updates
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1607
$path = 'HKLM:\Software\Policies\Microsoft\Windows Defender'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'EngineRing' -Value 2 -Type DWordIntune XML
No direct Policy CSP / OMA-URI mapping for this policy. Use the Intune Remediation tab, or ingest the ADMX in Intune.Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Select the channel for Microsoft Defender monthly engine updates
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1607
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows Defender' -Name 'EngineRing' -Expected 2 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Select the channel for Microsoft Defender monthly engine updates
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1607
$path = 'HKLM:\Software\Policies\Microsoft\Windows Defender'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'EngineRing' -Value 2 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Select the channel for Microsoft Defender monthly engine updates
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1607
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Select the channel for Microsoft Defender monthly engine updates
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1607
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows Defender' -Name 'EngineRing' -Expected 2 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Select the channel for Microsoft Defender monthly engine updates
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1607
$path = 'HKLM:\Software\Policies\Microsoft\Windows Defender'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'EngineRing' -Value 2 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.