Microsoft Defender Antivirus service disabled

[jimmy_2k]

Hi all, we're moving to Windows Defender Anti virus in Windows 10 22H2. When our devices were imaged there was a script run sc config "WinDefend" start= disabled. This permanently disabled the windows defender service and prevented it from running. Its also greyed out the Defender service options and as a result we cannot start the defender service without rebuilding the PCs. I've tried a few things and I just get access denied when I try net start commands etc. 

Anyone got any ideas??

[Oaktech]

sc config WinDefend start= auto
sc start WinDefend

Give that a go from an elevated prompt. As far as I'm aware it works on Pro skus upwards.

[jimmy_2k]

Thanks Oaktech, i've tired that and I get 

 

[SC] OpenService FAILED 5:

Access is denied.

 

😞 

 

The service seems to be locked and I can't get it to start

[Oaktech]

Hmmm... There is a suggestion that it can only be started by the system account, because that's what disabled it. 

 

You can try the NSudo tool which allows you to run commands as various built in users. It will report as a trojan because that's how it gains the respective permissions. 

 

https://github.com/azraelrabbit/NSudo-1

 

I use the Major Geeks download.

 

You can also try PSEXEC - it's less flexible, but arguably safer 

 

https://learn.microsoft.com/en-us/sysinternals/downloads/psexec

 

psexec \\localhost -s sc config WinDefend start= auto obj= "NT Authority\LocalService"

 

 

Edited March 27, 2025 by Oaktech