Windows Defender showing "Check Point Endpoint Security is out of date" on Windows 11 E88.10 E89.20

[kiikoo15]

Hello everyone,

I am experiencing an issue with Check Point Endpoint Security Client version 89.10.0370 on Windows 11.

Windows Security Center / Windows Defender keeps reporting a red alert under "Virus & threat protection", stating that "Check Point Endpoint Security protection is out of date" (Atualizações de proteção desatualizadas).

What I have tried so far:

Triggered "Client Repair" (Reparar Cliente) from the agent — completed, but did not fix the status.

Forced malware database updates directly on the client. The signatures on the Check Point agent itself are fully updated and green, but Windows Security Center does not register this update and remains in a warning/error state.

Verified connection to our Endpoint Management Server (policies are updating normally).

Has anyone faced this specific issue ?

Any help or insights would be highly appreciated.

Thanks in advance!

[jorgeluiznim · Accepted solution]

Hi @kiikoo15 ,

Good to see you back on CheckMates. This looks like a known, documented limitation rather than an actual protection failure — your Anti-Malware is genuinely up to date (the client is green); it's the Windows Security Center registration that's stale.

If your 89.10.0370 client is the Anti-Malware E2 (US-DHS / EU compliant) package — the "0370" DHS build — this matches AHTP-30337, listed under Known Limitations in sk183132 (E89.10 Windows Clients):

"For Endpoint Security Clients with Anti-Malware E2 (US-DHS and EU compliant), after an upgrade from E88.31 or lower to E88.40 or higher version, Check Point Endpoint Security is registered twice in the Windows Security Center. Reboot resolves the issue."

Since your title mentions coming from E88.10, that upgrade path fits exactly. What happens is that a stale/duplicate "Check Point Endpoint Security" provider stays registered in the Windows Security Center (WSC) and keeps reporting an old signature timestamp — so WSC shows "out of date" even though the live provider (and the client) are green.

Why your steps didn't clear it:

• Client Repair reinstalls/repairs client files but doesn't force WSC to drop the duplicate provider.
• Forcing signature updates updates the live provider, but the stale duplicate entry is the one WSC is alerting on.

What to try, in order:

1. Full reboot — per AHTP-30337 this is the documented fix (reboot once; if it persists, try a second time). The duplicate WSC registration is cleared on reboot.
2. Make sure Windows is fully updated first. AHTP-30337 notes that on machines lacking the Azure Code Signing dependencies, the double registration appears once Windows gains them — so run Windows Update to current, then reboot.
3. If it still shows after reboot, confirm the duplicate registration in an elevated PowerShell:

   Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct |
     Select-Object displayName, productState, timestamp

   If you see two "Check Point Endpoint Security" entries (one with an old timestamp), that confirms the stale duplicate. A reboot on a fully-updated Windows normally removes it; if a phantom entry survives, that's the point to open a TAC case referencing AHTP-30337, since manual WSC/WMI provider cleanup is best done with Support.

Could you confirm:

• Is this the Anti-Malware E2 / US-DHS package? (Client GUI > Anti-Malware, or the installed package name.)
• The exact upgrade path (E88.10 → E89.10, or via E89.20?) and whether the machine has been rebooted since the upgrade.

Bottom line: your endpoints are protected — this is a cosmetic WSC reporting issue from the double registration, and a reboot on a fully-updated Windows is the documented fix.

Reference: sk183132 (Enterprise Endpoint Security E89.10 Windows Clients), Known Limitations — AHTP-30337.

Best regards,
Jorge Dias Junior