Forum Discussion

Copper Contributor

Mar 10, 2022

Solved

Defender for Endpoint | Onboarding 2012R2 via local script | md4ws.msi with error id 15

Hi guys, we onboarded ~70 servers and everything went great so far. Our last 2012 R2 gets an error related to the sense service: event viewer: ms document: msi error: ...

KevinWBrown
Jul 07, 2022
Had this problem on multiple servers and traced to WinDefend service taking a long time to start added the following to the registry temporarily
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control]
"ServicesPipeTimeout"=dword:00075300
after a reboot ran md4ws manually (elevated) and it installed fine every time.

Copper Contributor

Mar 25, 2022

Hi PatrickEl,

thanks for your quick answer. I'll check the link you provide. But I believe we have to do the same way as you described.

Thx

carsten

Copper Contributor

Apr 01, 2022

Worked after these steps:

1.Upgrade Hyper-V Integration Services

2. Copying files from Windows 2012 R2 successfully installed to the system where the problem is

C:\Program Files\Windows Defender

C:\Program Files\Windows Defender Advanced Threat Protection

C:\ProgramData\Microsoft\Windows Defender

C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection

3. Export service regedit key from Windows 2012 R2 successfully installed to the system where the problem is

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sense]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdNisDrv]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdNisSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend]

4. Restart

5. Microsoft Defender for Endpoint offboarding process

run WindowsDefenderATPOffboardingScript.cmd

6. Run manual installation

run md4ws.msi

7. Restart

Perhaps some steps are not needed, let it be the subject of discussion

carlicht
Copper Contributor
Apr 01, 2022
Hi Yevhen,

thanks for the feedback. Will try it next week and give you feedback.

regards

Resources