Can't re-enable Windows Defender service even as administrator

Question

I found that my Windows Defender settings were disabled, saying 'managed by organization', so I followed this guide to fix it (essentially getting rid of the HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender key and subkeys. After a reboot, Windows Defender is still unable to start the service. A look at the service dialog and this is what I see:

The same problem for the related Windows Defender Antivirus Network Inspection Service. How do I fix this?

Edit - I found this in the event log -

The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.WscBrokerManager and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

I opened the Component services tool, but there's no mention of this component, and I don't know how to use this.

Answer 1

Things to try :

• If you have installed any third-party anti-virus, uninstall, reboot and try again. See this list for more thorough removal tools.

• Start an elevated Command Prompt (cmd) and run the command:

  sc start WinDefend Enable
  

• Run sfc /scannow

• Start Local Group Policy Editor (gpedit.msc), navigate to Computer Configuration\Administrative Templates\Windows Components\Windows Defender, double-click Turn off Windows Defender, and set to Not Configured

• Start an elevated Command Prompt (cmd) and run the following commands:

  regsvr32 wuaueng.dll
  regsvr32 wucltui.dll
  regsvr32 softpub.dll
  regsvr32 wintrust.dll
  regsvr32 initpki.dll
  regsvr32 wups.dll
  regsvr32 wuweb.dll
  regsvr32 atl.dll
  regsvr32 mssip32.dll
  

  You may use the free FixWin to do that, using its option "Repair Windows Defender. Reset all Windows Defender settings to default".

• In case of an an inconsistent WMI repository, run the command:

  winmgmt /verifyrepository
  

  If you get a message “WMI repository is not consistent“, run the following command:

  winmgmt /salvagerepository
  

• Start a Command prompt (cmd) as SYSTEM using "psexec -sid cmd.exe", launch services.msc from it, and the Startup type drop-down should now become enabled.

• Run deep anti-virus scans by several well-known anti-virus products. Many of these products offer online one-time scans.

• As last resort, Do a Repair Install of Windows 10 with an In-place Upgrade.

Before starting, ensure you have very good backups.

---

Edit:

Regarding the specific error message you found in the log, it seems like it's not a serious problem, but can be avoided.

The thread says this :

The problem in this case is that the service for Windows SecurityCenter (wscsvc) have a delayed autostart while "things" like the WscBrokerManager and WscCloudBackupProvider tries to initiate very early in the startup process. It will fail with error event 10016. wscsvc will initiate after ~2 minutes and then everything will be instantiated as normal so you will have no side effects of these errors in the event log but it's annoying.

You solve this by changing the service wscsvc from delayed autostart to normal autostart. You don't (normally) have permission to do it from the services app so you must do it in the registry.

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc

Change the DWORD DelayedAutoStart from 1 to 0.

Try this fix, maybe it has some more effects than it seems.