Understanding your update sources

When you don’t want, for example, your Windows servers getting Defender security intelligence updates directly from Windows Update, because you want to be more in control, here’s how you can find out where updates are coming from:

1. Check the logs. If you see an entry in any of the logs collected by mpcdmrun -getfiles (MpCmdRun.log, MpCmdRun-LocalService.log, MpCmdRun-NetworkService.log, and MpCmdRun-System.log), you know that updates are coming from ConfigMgr Windows Server Update Services (WSUS), WSUS standalone, the MMPC, or a file share.
2. If you’ve configured a policy to check for security intelligence updates at a specific interval, check the Windows Defender Operational event log. If you see that a security intelligence update is being applied, while none of the logs from step 1 show as downloading the file, you can probably conclude the update is coming from Microsoft Update directly.
3. To confirm, open WindowsUpdate...