After 2 weeks of continuous and determined investigation I finally managed to solve this mysterious puzzle (despite some serious setbacks and time loss) :)
The initial investigations were based on possible non-functionality of the Windows Defender (WD) service, which was failing to start. I spent a lot time trying various fixes such as, re-configuring firewall, re-registering system files, setting Windows services to default start-up, as well as restoring important Windows services using various scripts and commands and all of this did not work.
At this point I now didn't have a choice but to either re-install Windows or another Antivirus software (possibly a free solution) but I couldn't give up.
I even used group policy to disable and re-enable WD hoping for luck but it didn't work. I then reluctantly did a repair-upgrade, but to my surprise this didn't work also WD continued giving funny error messages like
Windows defender service couldn't be started. the system cannot find the path specified. and could not be started
I was now adamant that this was a case of messed up registry entries of WD, but I wasn't sure which entry to fiddle around with.
I then compared the WD registry entry:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend] with the one on my WindowsToGo installation I still exported the latter (though they were similar) but it didn't work.
I wasn't satisfied until I further dug in the registry to find the much awaited solution...
The culprit registry entry was:
I loaded the hive from the WindowsToGo installation and compared it with my current and found some clues:
The InstallLocation subkey had a strange key looking like
%ProgramData%\Microsoft\Windows Defender\Platform\<Version> instead of
%ProgramFiles%\Windows Defender thus I had to change accordingly.
In order to be granted permissions of this protected registry key, I had to take ownership of the key.
I rebooted the machine, and to delight the following sreenshots summaries the whole story:
- The wrong information in registry was causing (apparently it is the new path for WD in Windows 10 Creators Update) the WD to fail to start, and upon correcting all was OK. I apologise for posting the whole story but I had to, in the hope it be valuable to someone :)