Avast breaking Windows Defender Serivce (Disabled cannot enable)

[jezi55]

We recently had an email from Avast to say that they are going to start charging for the free education service they have provided the last couple of years. They can go do one as far as im aware! I am trying to uninstall Avast and enable windows Defender as this is already installed on my windows 10 machines but just disabled by a group policy. If i uninstall Avast through the management console this completly removes avast from the machine (silently too) but the fun comes when i try to enable the windows defender service. The group policy is set so that windows defender is enabled but when i go to services the Windows Defender Service is disabled and every option is greyed out to enable. I have tried registry entries to enable defender but with no luck.

 

The interesting thing is if i re-image my machine and put it in a different OU group so that avast does not get installed, i can run windows defender and it updates perfectly. Does anyone have any ideas as i dont really want to re-image 1000 devices before our deadline on 30/11/18.

 

Before anyone asks there is NO budget for antivirus.. I am currently awaiting feedback from Microsoft to see if we can upgrade our agreement so that we can use SCCM 2016.

 

Cheers guys.

 

--- Update---

 

It looks like the group policy is the culprit in breaking the windows defender. When i change the "turn off Windows Defender" from enabled to Disabled this is what is causing the service to be disabled. It is as if the group policy is apply the disable policy and then not taking off when the policy is changed.

 

---FIX---

 

Even after running rsop.msc and finding that the correct policies are being applied did not fix the issue.

 

sc config windefend start=auto​ - This command in an elevated cmd prompt seemed to enable the service even though everything was greyed out Happy days do not need to reimage 1000 machines!

 

--NOT FIXED--

 

After a reboot the service is disabled again

Edited October 31, 2018 by jezi55

[mrwoberts]

I'm thinking there is some other registry/GPO setting causing this. This isn't normal behaviour.

The fact that the start/stop/config options are greyed out is normal, this is a Trusted Installer privileged process.

 

Anything in the event logs? Take a look at the events for services that start/stop...

 

By the way, a group policy does not undo by selecting 'Not Configured', you have to reverse the change by toggling the opposite first, then later down the line you can select the 'Not configured', this is normal GP behaviour - thanks to MS.

[jezi55]

I finally found the solution, went through all of my GPO's and there was a GPO under System Services that was specifically disabling Windows Defender. Sometimes you have to take everything apart and start from scratch. Issue is now solved though