Forum Discussion

PatrickEl's avatar
PatrickEl
Copper Contributor
Mar 10, 2022

Defender for Endpoint | Onboarding 2012R2 via local script | md4ws.msi with error id 15

Hi guys,   we onboarded ~70 servers and everything went great so far. Our last 2012 R2 gets an error related to the sense service: event viewer: ms document:     msi error: ...
  • KevinWBrown's avatar
    KevinWBrown
    Jul 07, 2022
    Had this problem on multiple servers and traced to WinDefend service taking a long time to start added the following to the registry temporarily
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control]
    "ServicesPipeTimeout"=dword:00075300
    after a reboot ran md4ws manually (elevated) and it installed fine every time.
carlux1's avatar
carlux1
Copper Contributor
Hi PAtrick,

do you have received a feedback from Microsoft?

regards
Carsten
  • carlicht's avatar
    carlicht
    Copper Contributor
    Mar 25, 2022

    Hi PatrickEl,

     

    thanks for your quick answer. I'll check the link you provide. But I believe we have to do the same way as you described.

     

    Thx

    carsten 

    • YevhenTarasov's avatar
      YevhenTarasov
      Copper Contributor
      Apr 01, 2022

      Worked after these steps:

      1.Upgrade Hyper-V Integration Services

      2. Copying files from Windows 2012 R2 successfully installed to the system where the problem is

      C:\Program Files\Windows Defender

      C:\Program Files\Windows Defender Advanced Threat Protection

      C:\ProgramData\Microsoft\Windows Defender

      C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection

      3. Export service regedit key from Windows 2012 R2 successfully installed to the system where the problem is

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sense]

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdNisDrv]

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdNisSvc]

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend]

      4. Restart

      5. Microsoft Defender for Endpoint offboarding process

      run WindowsDefenderATPOffboardingScript.cmd

      6. Run manual installation

      run md4ws.msi 

      7. Restart

       

      Perhaps some steps are not needed, let it be the subject of discussion

      • carlicht's avatar
        carlicht
        Copper Contributor
        Apr 01, 2022
        Hi Yevhen,

        thanks for the feedback. Will try it next week and give you feedback.

        regards

Resources