SCCM Defender Fallback Source

[jtomren]

Hi

 

I have a question about the Fallback Source for definition updates. I have set “Updates distributed from configuration manager” first and next “Updates distributed from Microsoft Malware Protection center” (MPC). Definition updates from SCCM are installed every day as expected when a computer are on an internal network, but when I set a computer on a external network it does not fallback to MPC after the AuGracePeriod is over.  In the registry I notice that the following is set: InternalDefinitionUpdateServer|MicrosoftUpdateServer|MMPC. What I did not expect was the InternalDefinitionUpdateServer to be present at all when I set “Updates distributed from configuration manager”. I was sure that the InternalDefinitionUpdateServer only was set if choosing WSUS for update?

 

The expected behavior was that MPC was contacted after AuGracePeriod. But that does not happen and I suspect that the InternalDefinitionUpdateServer is the issue? Anyone know the best practice of setting up the fallback and why InternalDefinitionUpdateServer is set by both the choices “Updates distributed from configuration manager” and by “Updates distributed from WSUS”.