Logging Virus Definition Updates for MS Security Essentials in The Security Event Log

Question

I would like to log a security in event in Windows 7 whenever the Microsoft Security Essentials 2 virus definition files are updates, deleted, or changed. I was expecting to do this with an Audit setting on one of the MS Security Essentials folders but I wasn't sure which one and how to avoid getting swamped with messages.

What folder or files should I audit to track definition updates (or corruption) in the security events or is there a better approach?

Answer 1

This can't be done. instead use the Windows Update log (%SystemRoot%\WindowsUpdate.log)instead.

Answer 2

Microsoft support provided the following response to this question:

As of now, MSE does not have any such features or user commands that can be used to monitor the changes to its files. However, it protects itself by locking those files and denying access to third party programs or even the user.

Your audit log to monitor C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates folder will take care of the requirement. And this is what our Research Team suggest and recommend.