Are you fetching updates from a SUS or WSUS server, or from Microsoft?
How to troubleshoot Windows Update, Microsoft Update, and Windows Server
Update Services installation issues
If your windows update is pointing to your local WSUS, then you must include
the Windows Defender in synchronization setting.
In Products selection, please include Windows Defender
In Update classifications, please include Definition Updates
You must synchronize the server and approve the definition for clients to
get the latest definition.
You experience problems when you access the Windows Update Version 5 or
Version 6 Web site through a server that is running ISA Server