Author Topic: Windows Defender Won't Turn Off After Running Repair (Read 33137 times)

Mighty Joe · « **on:** August 09, 2016, 07:28:15 am »

Hi,

After running Tweaking 3.9.7 Windows Defender service has been changed to Automatic and the options to disable are greyed out. Because I have Windows 10 Home there is no Group Policy. How can I disable Defender from running? I use Avira free and Malwarebytes Anti-Malware paid so have no need for Defender.

Thank you

Boggin · « **Reply #1 on:** August 09, 2016, 09:18:13 am »

When you run an AV program that doesn't have its own firewall then WD will remain active as the Windows Firewall aspect will remain running.

I use Norton Security which auto disables WD because it has its own firewall.

Are you getting any adverse effects with both running - such as slow ?

Mighty Joe · « **Reply #2 on:** August 09, 2016, 09:32:24 am »

Thanks for your quick reply. I feel my computer is running a bit slower. Before I ran Tweaking I was able to disable WD through my services.msc If Tweaking did not grey out the disable selection for WD I don't know what else could have. Would I have to change a registry setting to disable it?

Boggin · « **Reply #3 on:** August 09, 2016, 01:09:36 pm »

There has been another report of a computer running slow after using WR, but use Option 5 to restore the registry to take it back to before you ran WR to see if that improves performance and if you are then able to disable WD.

It is advocated that WR is ran twice to effect the repairs of the first run, but you could also uninstall Avira, using its Uninstaller to see if that also improves performance and then that might determine if the two AV programs are conflicting or if the slow is a result of running WR.

Mighty Joe · « **Reply #4 on:** August 09, 2016, 01:46:09 pm »

I was hoping there is a manual registry fix I could do just for WD rather than revert all WR changes. WR causing the end user to be unable to disable a service is a huge issue and one I hope your team will correct in the next WR release.

Boggin · « **Reply #5 on:** August 09, 2016, 01:50:16 pm »

Why did you need to run WR ?

I'll pass on your findings to Shane, but have you tried what I've suggested - you can always run the repairs again.

EDIT - Can you use Option 5 to restore the registry and then run the repairs with v3.9.9 to see if you get the same problem.

Mighty Joe · « **Reply #6 on:** August 09, 2016, 02:50:36 pm »

I'll try Option 5 then run 3.9.9 later tonight. You mentioned earlier about running the repair twice in a row? That's the first I head that suggestion but I'll do that and report back to you.

Thanks Boggin

Mighty Joe · « **Reply #7 on:** August 09, 2016, 07:38:55 pm »

I restored my registry back three days via Option 5, then reran WR, ignoring the option to "restore Windows services to the default level". My WD remains greyed out, unable to disable it.

Boggin · « **Reply #8 on:** August 10, 2016, 12:44:35 am »

I haven't had a reply back from Shane on this yet but from what I've found, the only option to disable WD is by using the Group Policy Editor which isn't available in Win 10 Home - you need Win 10 Pro.

However, this article suggests a 3rd party program can do it for you if you want to give that a go, which may override what is greying it out.

http://winaero.com/blog/disable-or-enable-windows-defender-in-windows-10/

You may also be able to disable the Windows Defender services by going Start - type services.msc and press enter.

Scroll down where you will see three of them.

In mine they are set to Manual, but I don't know if that is because I have Norton Security.

Click on each and a description of what each does will appear in the upper left pane.

Right click on each and select Properties then use the dropdown to change its status to Disabled - Apply - Stop - OK - File - Exit then reboot and then you can check its status where you would normally be able to turn it off.

I'm not sure if you would get any nags that it was disabled, but you may have to manually enable Windows Firewall to supplement Avira.

Mighty Joe · « **Reply #9 on:** August 10, 2016, 10:02:43 am »

Thanks for the heads up on Winaero Tweaker. It had several useful tweaks which I implemented. It did disable WD which is good however it locked it on "manual"; the ability to change the status is still greyed out.

I'd really like to get WD back to where it remains disabled but allows me to change the status of it if I want just as with other services. I may do a system restore at some point because I'm not sure what else can be done.

While you're awaiting a reply from Shane maybe you can ask him as well if there's a way that in future releases, he can make the logs notate which errors may be benign. For instance, I have a lot of "access is denied" in my "services set permissions" log and I'm not sure which if any are legit problems that need attention and which are simply inherent to Windows 10 and/or Avira.

Boggin · « **Reply #10 on:** August 10, 2016, 03:07:33 pm »

I'll ask him about those services set to Access Denied and if he can have the logs give more info.

They tend to just say Done.

Can you post the log which shows the Access Denied as I've linked your thread into my email to him.

Is your Windows Firewall turned on as Avira doesn't have its own firewall ?

Mighty Joe · « **Reply #11 on:** August 10, 2016, 07:37:29 pm »

Thanks for taking a look at my logs, Boggin. Much appreciated. Here's the Services_Set_Permissions_Error_Log:

ERROR: Writing Security Info to <AppIDSvc> failed with: Access is denied.
ERROR: Writing Security Info to <AppXSvc> failed with: Access is denied.
ERROR: Writing Security Info to <ClipSVC> failed with: Access is denied.
ERROR: Writing Security Info to <CoreMessagingRegistrar> failed with: Access is denied.
ERROR: Writing Security Info to <DPS> failed with: Access is denied.
ERROR: Writing Security Info to <EFS> failed with: Access is denied.
ERROR: Writing Security Info to <EntAppSvc> failed with: Access is denied.
ERROR: Writing Security Info to <gpsvc> failed with: Access is denied.
ERROR: Writing Security Info to <LSM> failed with: Access is denied.
ERROR: Writing Security Info to <msiserver> failed with: Access is denied.
ERROR: Writing Security Info to <sppsvc> failed with: Access is denied.
ERROR: Writing Security Info to <StateRepository> failed with: Access is denied.
ERROR: Writing Security Info to <tiledatamodelsvc> failed with: Access is denied.
ERROR: Writing Security Info to <WdiServiceHost> failed with: Access is denied.
ERROR: Writing Security Info to <WdiSystemHost> failed with: Access is denied.
ERROR: Writing Security Info to <WdNisSvc> failed with: Access is denied.
ERROR: Writing Security Info to <WinDefend> failed with: Access is denied.
ERROR: Writing Security Info to <WpnService> failed with: Access is denied.
ERROR: Writing Security Info to <WSService> failed with: Access is denied.
ERROR: Writing Security Info to <AppIDSvc> failed with: Access is denied.
ERROR: Writing Security Info to <AppXSvc> failed with: Access is denied.
ERROR: Writing Security Info to <ClipSVC> failed with: Access is denied.
ERROR: Writing Security Info to <EntAppSvc> failed with: Access is denied.
ERROR: Writing Security Info to <msiserver> failed with: Access is denied.
ERROR: Writing Security Info to <sppsvc> failed with: Access is denied.
ERROR: Writing Security Info to <StateRepository> failed with: Access is denied.
ERROR: Writing Security Info to <tiledatamodelsvc> failed with: Access is denied.
ERROR: Writing Security Info to <WdNisSvc> failed with: Access is denied.
ERROR: Writing Security Info to <WinDefend> failed with: Access is denied.
ERROR: Writing Security Info to <WpnService> failed with: Access is denied.
ERROR: Writing Security Info to <WSService> failed with: Access is denied.

I also got "access denied" errors on the Repair_Network, Repair_MSI_Windows_Installer, and HKLM/HKU_Set_Owner/Set Permissions_Error logs. I'd love to post those for your review as well if that's OK?

Willy2 · « **Reply #12 on:** August 10, 2016, 07:43:38 pm »

@Mighty Joe:
- Did you run all repairs in one run ?
- You can use Windows Repair (WR) to change the start up state of the Windows Defender Service. Go to the main repair screen WR, select/click on the "Repair Info" tab and select the info for repair #27. That info will tell you how to disable the "Windows Defender" Service using WR.
- Keep us posted !!!!

@Boggin:
"When you run an AV program that doesn't have its own firewall then WD will remain active as the Windows Firewall aspect will remain running. I use Norton Security which auto disables WD because it has its own firewall."

Does this apply to Win 10 only ? I thought WD & the Firewall had their own Service and that they wouldn't influence each other.

Willy2 · « **Reply #13 on:** August 10, 2016, 07:51:12 pm »

- Did this problem surface before the "Anniversary Update" ?

Mighty Joe · « **Reply #14 on:** August 10, 2016, 08:07:01 pm »

@Willy2:
I ran all repairs in one run. From what I can see Option 27 does not disable WD. Below is the repair information from WR on what option 27 specifically does:

Set Windows Services To Default Startup:
================================
This will set the Windows Services to their default startup state. This repair is loosely based on info found at http://www.blackviper.com.

By default this repair will enable:
- the Windows Firewall Service, called "SharedAccess" (XP) or "Mpssvc" (Vista & newer).
- the Windows Defender Service called "WinDefend" (Vista & newer).
- the Windows Search Service

I ran WR on 8/6 and 8/9 (yesterday), after the Anniversary Update.

Thanks

Willy2 · « **Reply #15 on:** August 11, 2016, 12:17:34 am »

- Yes, the DEFAULT setting in repair #27 is to enable the WinDefend Service. But the user is able to customize/change those settings. Scroll down in that tab for more info.

Mighty Joe · « **Reply #16 on:** August 11, 2016, 12:50:45 am »

I now see what you mean. Even if I rerun WR using the command to disable WD I suspect the option to change its state (if I so choosed to) will again be greyed out and I'll be back to where I was after I ran WR on 8/9. Unless someone can tell me differently.

Willy2 · « **Reply #17 on:** August 11, 2016, 01:04:53 am »

- I fear you'll be right. But then you know how to disable the Service using this repair if you choose to use WR again.

Boggin · « **Reply #18 on:** August 11, 2016, 01:19:15 am »

[quote @Boggin:
"When you run an AV program that doesn't have its own firewall then WD will remain active as the Windows Firewall aspect will remain running. I use Norton Security which auto disables WD because it has its own firewall."

Does this apply to Win 10 only ? I thought WD & the Firewall had their own Service and that they wouldn't influence each other.
[/quote]

You may be right on that.

WD started life in Win 8.0 and was a combo of MSE and the old WD from Win 7 and backed up with Windows Firewall.

While WD was showing as Manual but not started in my Win 10 running Norton Security, I'm unable to ascertain the status of WD and Windows Firewall with a freebie AV, but running an AV that had its own firewall would have the same effect on WD in Win 8/8.1

While you can sometimes run two AV programs together - I've seen people running Avast Free alongside MSE without problems

Willy2 · « **Reply #19 on:** August 11, 2016, 01:44:28 am »

- The point is that one can ALWAYS use a Firewall in combination with ANY AV program. (And Defender in Win 8 or higher is an AV). The problem is some AV come with an extra Firewall and then (somehow) the user can end up with more than one Firewall (running). I once saw a system with 3 (!!!) firewalls running. No wonder that system was "a bit slow".
- The graying out problem: I assume that's one of the many (small (???)) bugs in every version of Windows.
- The "Access Denied" problem: Yes, I assume that's AVIRA protecting some sensitive parts of the OS.

Boggin · « **Reply #20 on:** August 11, 2016, 01:50:16 am »

Not if WR is run in Safe Mode - Avira isn't loaded in that mode which is why it's advocated WR be run in Safe Mode so that an AV program doesn't interfere with the repairs.

However, Windows Firewall remains or is activated in Safe Mode.

Mighty Joe · « **Reply #21 on:** August 11, 2016, 01:57:36 am »

Btw since you mentioned safe mode...I did run WR in safe mode with networking as the program suggests.

Willy2 · « **Reply #22 on:** August 11, 2016, 02:04:18 am »

- When run in Safe Mode then AVIRA (or any other AV) isn't loaded. But does that mean all the permissions the AV has changed, are reverted to their previous states for the duration that Safe Mode is active ? I could be wrong but I highly doubt it.

Boggin · « **Reply #23 on:** August 11, 2016, 02:51:38 am »

I wasn't aware that an AV program changed permissions.

Willy2 · « **Reply #24 on:** August 11, 2016, 07:57:22 am »

- Oh, yes. And I know that MS doesn't share ALL it secrets with the general public. Otherwise AV programs would have been useless.