Server 2016 not able to install Windows Defender

[Flemming Bruhn]

It seems that everything but what has been copied from your previous fix-files are missing

 

[Maxstar]

Yes, almost every component of Windows Defender is missing.

Note: Please make first a backup of this server.

The fix is too large to attach, so I've uploaded it here: SFCFix.zip

Warning: This fix was written specifically for this system. Do not run this fix on another system.

• Save any work you have open, and close all programs.
• Download the attachment SFCFix.zip and save it to your desktop.
• Drag the SFCFix.zip file over the SFCFix.exe executable and release it.

• SFCFix will launch, let it complete.
• Once done, a file will appear on your desktop, called SFCFix.txt.
• Post the logfile (SFCFix.txt) as attachment in your next reply.

Afterwards try to install the Defender Feature again.

 

[Flemming Bruhn]

The Fix ran smooth and the dism installation of Defender succeded.

However the service is not started, so I guess I need to restart the server, but that will have to wait until everyone has gone home.

If I go to servermanager - add features the Defender items are now showing that they are installed.

A strange thing is that the Windows defender folder in Program Files are empty.

 

[Maxstar]

Yes, perform a restart first, with the following we could check the the services.

WMIC SERVICE GET caption, name, startmode, state > "%userprofile%\desktop\services.txt"

If I go to servermanager - add features the Defender items are now showing that they are installed.

Perhaps a reboot is needed?

 

[Flemming Bruhn]

I am sorry, but a reboot did not change anything.
The Windows Defender folder in Program Files are still empty and as you can see in the services file there is no trace of Windows Defender.
It is strange as the Dism said that installation was successful and that the Server Manager GUI shows that it is installed.

I made a snapshot of the server before running the last big fix file that fed all the defender stuff to the WinSxS folder and updated the registry, should I revert to that snapshotany? It seems that everyting (but Windows Defender) is running as normal.

I am sorry to be such a bother and fully understand if you can't use anymore time on me. If it's so, I must leave it as it is and create new DC's after the summerbreak.

 

[Flemming Bruhn]

In the Gui it tells me that Windows Defender is not installed.
I have tried to copy the files from another 2016 server where Defender is installed to this server.
When I do that the GUI tells me that Defender has not been started, but when I click start I am told that I don't have the rights to start it.

Right now I have removed the files from the Windows Defender folder in Program Files again and saved them in the Temp folder.

For a moment it seemed to be close.

 

[Maxstar]

Hi,

Export registry key as hive file.

• Open the Start menu of Windows and type CMD.
• When you see Command Prompt on the list, select the option Run as administrator.
• Copy and paste the following commands one at a time into the command prompt and press enter after each.

reg save "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services" "%userprofile%\Desktop\Services.hiv"

• Once done, a file will appear on your desktop, called Services.hiv.
• ZIP this file and attach it to your next reply.

 

[Flemming Bruhn]

Hi, and once more thak you

 

[Maxstar]

Please perform the following to restore the missing services.

Warning: This fix was written specifically for this system. Do not run this fix on another system.

• Save any work you have open, and close all programs.
• Download the attachment SFCFixScript.txt and save it to your desktop.
• Drag the SFCFixScript.txt file over the SFCFix.exe executable and release it.

• SFCFix will launch, let it complete.
• Once done, a file will appear on your desktop, called SFCFix.txt.
• Post the logfile (SFCFix.txt) as attachment in your next reply.

Afterwards try to start Defender.

 

[Flemming Bruhn]

I have run the script and the values are imported to regestry, but the path in ProgramData does not have the needed files.

If I try to Turn on Windows Defender from the GUI it tries to start form Program Files, and if I try to start the service from services it tries to start the service from ProgramData where the needed files are missing.

Should we give up?

 

[Maxstar]

You could try to copy the %ProgramData%\Windows Defender folder of the other server as well to see what happens.

 

[Flemming Bruhn]

I have given up. I have deleted the Windows Defender entry in HKLM\system\currentControlSet\Services and rebooted the server.

Thank you for your effort, but this server was really messed up, with all the application files missing as well.

 

[Maxstar]

Hi,

You're welcome. And I agree this server is really messed up, I also wonder in which way Windows Defender was uninstalled in the past, probably not the right way...