Forum Discussion

Björn Lagerwall's avatar
Björn Lagerwall
Brass Contributor
Oct 15, 2020

Windows Defender cannot be started on Windows Server 2012/2016 - must be manually started

Hi all,

 

Replacing Sophos AV with Defender ATP.  Have a problem with defender service (via GPO or services mmc) is not automatically starting after uninstalling Sophos. I must go into Defender GUI to manually start it. 

 

Sophos is fully uninstalled and I cannot find any registry settings that would still prevent the defender service to start. "Error 577: Windows cannot verify the digital signature for this file...". When manually starting and clicking "Start now" in Windows Defender GUI it starts successfully.  

 

Note that the problem occurs on our older servers, Windows Server 2012R2/2016 only. Not too keen on doing this manual start on 150 servers...

 

Any suggestions?

 

Thanks

  • Björn Lagerwall's avatar
    Björn Lagerwall
    Nov 24, 2020

    SOLUTION FOUND: Remove Defender AV role on server. Add it again and the service starts.

  • Leon Laude's avatar
    Leon Laude
    Iron Contributor

    Hi Björn Lagerwall,

     

    Did you try restart any of the servers after uninstalling Sophos? It might simply require a restart, as Windows probably doesn't know or has its information updated that the third-party antivirus software has been removed.

     

    Another way would be to simply script this with PowerShell to go through all affected 150 servers (for example make a list), have the script iterate though the list and start the Windows Defender service (WinDefend).

     

    Example:

    Get-Content "C:\Temp\ServerList.txt" | ForEach-Object {
    Start-Service -Name "WinDefend"
    }

     

    Best regards,
    Leon

      • Leon Laude's avatar
        Leon Laude
        Iron Contributor

        I've heard about this issue, but no real workaround, easiest is to script this, you can either turn on the Windows Defender with scripts, or you can change the registry entry for the service (which I wouldn't recommend).

Resources