Forum Discussion

Brass Contributor

Oct 15, 2020

Solved

Windows Defender cannot be started on Windows Server 2012/2016 - must be manually started

Hi all, Replacing Sophos AV with Defender ATP. Have a problem with defender service (via GPO or services mmc) is not automatically starting after uninstalling Sophos. I must go into Defender GUI...

security

Windows Server

Björn Lagerwall
Nov 24, 2020
SOLUTION FOUND: Remove Defender AV role on server. Add it again and the service starts.

Björn Lagerwall

Brass Contributor

Oct 15, 2020

Leon Laude thanks for your reply, but multiple reboots does not do any difference.

Leon Laude

Iron Contributor

Oct 15, 2020

I've heard about this issue, but no real workaround, easiest is to script this, you can either turn on the Windows Defender with scripts, or you can change the registry entry for the service (which I wouldn't recommend).

Björn Lagerwall
Brass Contributor
Oct 17, 2020
Leon Laude Unfortunately, the script does not work as start-service, I guess it is doing basically the same as starting service via services.msc MMC.

Starting Defender via GUI is bad, but at least it works. On our machines running Windows Server 2016 Core I cannot get to run though.
- Leon Laude
  Iron Contributor
  Oct 18, 2020
  Sounds troublesome indeed, in your case I'd raise a support request directly to Microsoft:
  https://support.serviceshub.microsoft.com/supportforbusiness
  - Björn Lagerwall
    Brass Contributor
    Nov 16, 2020
    I ended up with in-place upgrading all 2016 core with this issue to Windows Server 2019 core.
    
    That enabled the service properly.