2

I found that my Windows Defender settings were disabled, saying 'managed by organization', so I followed this guide to fix it (essentially getting rid of the HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender key and subkeys. After a reboot, Windows Defender is still unable to start the service. A look at the service dialog and this is what I see:

This is while running as administrator, goes without saying

The same problem for the related Windows Defender Antivirus Network Inspection Service. How do I fix this?

Edit - I found this in the event log -

The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.WscBrokerManager and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

I opened the Component services tool, but there's no mention of this component, and I don't know how to use this.

  • Can you set the Start DWORD to 3 under: set:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend then restart the computer. I assume it's then started even if you can't change it from services.msc. – HelpingHand Nov 3 '18 at 9:24
  • It got changed to 'manual', and when I open security center I'm back to square one - 'all settings managed by organization', and under gpedit.msc everything has been verifiably set to 'not configured'. – Rex Nov 3 '18 at 11:16
2

Things to try :

  • If you have installed any third-party anti-virus, uninstall, reboot and try again. See this list for more thorough removal tools.

  • Start an elevated Command Prompt (cmd) and run the command:

    sc start WinDefend Enable
    
  • Run sfc /scannow

  • Start Local Group Policy Editor (gpedit.msc), navigate to Computer Configuration\Administrative Templates\Windows Components\Windows Defender, double-click Turn off Windows Defender, and set to Not Configured

  • Start an elevated Command Prompt (cmd) and run the following commands:

    regsvr32 wuaueng.dll
    regsvr32 wucltui.dll
    regsvr32 softpub.dll
    regsvr32 wintrust.dll
    regsvr32 initpki.dll
    regsvr32 wups.dll
    regsvr32 wuweb.dll
    regsvr32 atl.dll
    regsvr32 mssip32.dll
    

    You may use the free FixWin to do that, using its option "Repair Windows Defender. Reset all Windows Defender settings to default".

  • In case of an an inconsistent WMI repository, run the command:

    winmgmt /verifyrepository
    

    If you get a message “WMI repository is not consistent“, run the following command:

    winmgmt /salvagerepository
    
  • Start a Command prompt (cmd) as SYSTEM using "psexec -sid cmd.exe", launch services.msc from it, and the Startup type drop-down should now become enabled.

  • Run deep anti-virus scans by several well-known anti-virus products. Many of these products offer online one-time scans.

  • As last resort, Do a Repair Install of Windows 10 with an In-place Upgrade.

Before starting, ensure you have very good backups.


Edit:

Regarding the specific error message you found in the log, it seems like it's not a serious problem, but can be avoided.

The thread says this :

The problem in this case is that the service for Windows SecurityCenter (wscsvc) have a delayed autostart while "things" like the WscBrokerManager and WscCloudBackupProvider tries to initiate very early in the startup process. It will fail with error event 10016. wscsvc will initiate after ~2 minutes and then everything will be instantiated as normal so you will have no side effects of these errors in the event log but it's annoying.

You solve this by changing the service wscsvc from delayed autostart to normal autostart. You don't (normally) have permission to do it from the services app so you must do it in the registry.

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc

Change the DWORD DelayedAutoStart from 1 to 0.

Try this fix, maybe it has some more effects than it seems.

  • Thanks for the detailed steps. - Not using any 3rd party AV, sfc reported no problems and I had already reset group policy to nil. - WMI repository is reported consistent. - psexec trick worked, now was able to make the service startup automatically, but I can't start it from there(1053: service did not respond in a timely fashion). But after all this, when I click the button in Defender Security Center to restart the threat service, it again reports an 'unexpected' error. – Rex Nov 4 '18 at 4:44
  • I have added two more steps, which I hoped wouldn't be necessary. – harrymc Nov 4 '18 at 8:25
  • I found something else in the event log..have updated the question. – Rex Nov 6 '18 at 8:41
  • What is the event id? – harrymc Nov 6 '18 at 8:54
  • I added to my answer. – harrymc Nov 6 '18 at 9:01

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.