Forum Discussion
Björn Lagerwall
Oct 15, 2020Copper Contributor
Windows Defender cannot be started on Windows Server 2012/2016 - must be manually started
Hi all, Replacing Sophos AV with Defender ATP. Have a problem with defender service (via GPO or services mmc) is not automatically starting after uninstalling Sophos. I must go into Defender GUI...
- Nov 24, 2020
SOLUTION FOUND: Remove Defender AV role on server. Add it again and the service starts.
Leon Laude
Oct 15, 2020Iron Contributor
Hi Björn Lagerwall,
Did you try restart any of the servers after uninstalling Sophos? It might simply require a restart, as Windows probably doesn't know or has its information updated that the third-party antivirus software has been removed.
Another way would be to simply script this with PowerShell to go through all affected 150 servers (for example make a list), have the script iterate though the list and start the Windows Defender service (WinDefend).
Example:
Get-Content "C:\Temp\ServerList.txt" | ForEach-Object {
Start-Service -Name "WinDefend"
}
Best regards,
Leon
- Björn LagerwallOct 15, 2020Copper Contributor
Leon Laude thanks for your reply, but multiple reboots does not do any difference.
- Leon LaudeOct 15, 2020Iron Contributor
I've heard about this issue, but no real workaround, easiest is to script this, you can either turn on the Windows Defender with scripts, or you can change the registry entry for the service (which I wouldn't recommend).
- Björn LagerwallOct 17, 2020Copper Contributor
Leon Laude Unfortunately, the script does not work as start-service, I guess it is doing basically the same as starting service via services.msc MMC.
Starting Defender via GUI is bad, but at least it works. On our machines running Windows Server 2016 Core I cannot get to run though.