I installed a fresh server 2016 STD and joined to Domain. and logged in with domain administrator user.

I got the error below when I opened Windows Defender from Settings.

The error says it doesn't have permission. But I have logged in with Domain administrator:

snapshot error


This may be a problem with the local security policy. It can be easily changed.

Access the local security policy GUI by gpedit.msc into cmd or run. If that doesn't work you can go to Server Manager --> Tools --> Group Policy Management`

Once your there go to

Computer Configuration-> Windows Settings-> Security Settings -> Local Policies-> Security Options

then enable the policy that says "User Account Control: Admin Approval Mode for the Built-in Administrator account"

Once you do this, you must restart

  • This was easy way. But restart is required. once we change in Group Policy – MacUser Jul 27 '17 at 10:22
  • Glad to hear that. Sorry about the restart – Nicholas Awesomepants Jul 27 '17 at 20:12

Mhm. It seems the file permission for the file is the issue. Let's try to modify that, since it is not allowing you with domain Administrator.

  1. Download the PsExec tool from Microsoft's Website, here. Open a normal Administrator Command Prompt (Win+X then Command Prompt (Admin)). In it run, psexec –i –s CMD after changing directory (cd) to the executable's location. If prompted with password, enter. If asked for the SYSTEM password, it should be nothing so just press enter. This should allow you to run the computer as NT_Authority\System.

  2. Run this command to grant the Domain Administrator permission to access it. Replace the Administrator with whatever Administrator you are using for example MyNiceServer\Administrator, I'd also just run Administrator for the local system as well.

icacls "C:\Program Files\Windows Defender\msascui.exe" /grant Administrator:(F,WDAC)


What worked for us was to browse directly to the file, right-click and select 'run as administrator'. This should not require any changes to system or reboots.

C:\Program Files\Windows Defender\MSASCui.exe

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.