Windows 10 22H2, KB5016616, KB5017308, KB5017380, KB5018410, KB5019959, KB5021233 hang on reboot after install

I did some more digging. I cleared the Win Update log folder and tried a manual install of KB-5017308. It failed but I have the update logs. I'm not an expert but I see the same Windows Defender update being installed at least a dozen times, KB-2267602. Its the last thing that happened before I did the double reboot. Does anyone else see this in their log files located in C:\Windows\Logs\WindowsUpdate? You will need PerfView to see the logs https://www.microsoft.com/en-us/download/details.aspx?id=28567.  I have my log files and will gladly upload them but don't see a way of doing that here. I included the end of the log file here. It seems like it keeps trying to install the defender update.

ThreadID="1,400" Info="Deserialized installable update Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.375.515.0), UpdateID = {B7EFB2DC-2B14-4D03-83E9-1C2FBAFB43E7.200}, CallbackInfo cookie length = 0" 

Hi glezbsg. Good one - you may have spotted something here.

FYI, you can see the logs (System log in this case) here:

Control panel all items/Administrative Tools/Event Viewer/Windows logs/System

When you say you have seen the Defender message dozens of times - I assume you mean, separated, once every reboot, not dozens in succession? And in that sense, Yes.. So KB 2267602 (Defender) is successfully installed - then freezes the system! But it then gets more interesting - clearly this is the precursor to the dots freeze. See the sequence below, with a pause in time before the hard restart shown.

(NB, the time sequence here is bottom up, as per the log. "=" between each message at this point.)

=

Then off & away on the reboot processes

=

23:11:31 The process C:\Windows\System32\RuntimeBroker.exe (AJAS8) has initiated the restart of computer AJAS8 on behalf of user AJAS8\andy for the following reason: Other (Unplanned)

Reason Code: 0x0

=

23:10:35 The start type of the Windows Modules Installer service was changed from demand start to auto start.

=

23:08:28 The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}

=

22:49:49 Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.373.1190.0) Reason Code: 0x0

=

Prior to this, long sequence of messages in rapid succession, as normal, but ending with 6 seconds to install KB2267602

=

SO - does that mean that Defender does not like 5016616 etc?

Next - so can Defender be made inactive? No time now - 02:25 here in UK

Final note to check more: KB2267602 is showing installed on my PC - but on the day (4/9) when 5016616 was no longer offered - and replacement KB5017308 not yet born. So I got through an Update cycle without freeze. VERY interesting. But I have not tried again since - have to actually use the PC sometimes.

"When  you say you have seen the Defender message dozens of times - I assume you mean, separated, once every reboot, not dozens in succession"

@OldAJAS, no in succession. One after another. If you look at the log snippet I posted above, it was the end of the log file after recovery. There are maybe 6 more before I aborted the install and clean up. 2 other log files have more of the same in succession and I'm assuming those logs are from the first reboot attempt. I don't know how to post the logs so y'all can take a look at them.

Can you look at your update logs with PerfView to see if you have the same scenario? Open the .etl file the logs are under Events | WuTraceLogging.

Nothing of significance is in the Setup system logs.

I'm going out on a limb here but that update is from 2021 which means that Windows Defender has not updated since then? Others have had problems with this defender update and have cleared out the definitions to cure.

https://www.elevenforum.com/t/security-intelligence-update-for-microsoft-defender-antivirus-kb2267602-version-1-361-1370-0-install-error-0x80070643.5673/

https://learn.microsoft.com/en-us/answers/questions/343287/windows-10-updates-from-39ball-of-confusion39-to-f.html

Must be run as administrator:

cd %ProgramFiles%\Windows Defender

MpCmdRun.exe -removedefinitions -dynamicsignatures

MpCmdRun.exe -SignatureUpdate

So clearing the defender definitions did not work. KB5017308 still tries installing the defender update 3 times before the 1st reboot and 6 times after the recover reboot. I have 3 log files, one after running the install before the reboot, an empty one which I assume is the aborted attempt and one after the repair. And KB2267602 is not available from the MS Catalog site to try a manual install.

It would be good to know if anyone else is seeing this.