Microsoft Defender for Endpoint
Endpoint protectionManage Gradual Rollout
In brief
The page now documents using MpCmdRun.exe on Windows to roll back Microsoft Defender Antivirus platform updates to the previous version or the Windows inbox version. It also notes additional rollback support in platform version 4.18.26030.3011 or later.
What Defender admins need to know
Administrators have a documented recovery option if a platform update causes issues.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
- tier2
ms.topic: how-to
ms.subservice: ngp
ms.date: 2026-
07-02T00:10-23T00:00:00.0000000Z ai-usage: ai-assisted ms.custom: msecd-doc-authoring-1016 locale: en-us
Updates are released monthly using a gradual release process. The gradual release process helps enable early failure detection to identify issues as they occur and address them quickly before a larger rollout.
If an update causes issues, you can use MpCmdRun.exe to roll back Microsoft Defender Antivirus platform updates on Windows to the previous version or to the version included with Windows (the inbox version). In platform version 4.18.26030.3011 or later, you can also roll back endpoint detection and response (EDR) updates to the inbox version or to the previously installed (N-1) version, if a backup is available. For requirements and command options, see Use the command line to manage Microsoft Defender Antivirus.
Note
For more information on how to control daily security intelligence updates, see Schedule Microsoft Defender Antivirus protection updates. Updates ensure that next-generation protection can defend against new threats, even if cloud-delivered protection is not available to the endpoint.
@@ -19,7 +19,7 @@ ms.collection: - tier2 ms.topic: how-to ms.subservice: ngp-ms.date: 2026-07-02T00:00:00.0000000Z+ms.date: 2026-10-23T00:00:00.0000000Z ai-usage: ai-assisted ms.custom: msecd-doc-authoring-1016 locale: en-us@@ -60,6 +60,8 @@ Capabilities are provided through several components:
Updates are released monthly using a gradual release process. The gradual release process helps enable early failure detection to identify issues as they occur and address them quickly before a larger rollout.
+If an update causes issues, you can use `MpCmdRun.exe` to roll back Microsoft Defender Antivirus platform updates on Windows to the previous version or to the version included with Windows (the inbox version). In platform version 4.18.26030.3011 or later, you can also roll back endpoint detection and response (EDR) updates to the inbox version or to the previously installed (N-1) version, if a backup is available. For requirements and command options, see [Use the command line to manage Microsoft Defender Antivirus](command-line-arguments-microsoft-defender-antivirus).
+
Note
For more information on how to control daily security intelligence updates, see [Schedule Microsoft Defender Antivirus protection updates](manage-protection-update-schedule-microsoft-defender-antivirus). Updates ensure that next-generation protection can defend against new threats, even if cloud-delivered protection is not available to the endpoint.