Solved How do I restore Windows Defender?

I’m sure there is a reason that you may have mentioned why you can’t. But It’s my personal opinion it’s time you did a totally fresh install of Windows. It sounds like a Cluster Duck.

garlin said:

You probably can't change any settings if Tamper Protection is enabled. This prevents "unauthorized" changes even if you're TI.

Boot into Safe Mode, and try again after disabling the Defender services.

Click to expand...

Just rebooted in safe mode. There Windows Defender is still running and there is no way to stop it.

garlin said:

No the point is you wanted to re-import the Defender settings. If Tamper Protection is enabled, Defender protects the registry from Defender reg changes. So you have to disable Defender to change Defender...

Tamper Protection works on the kernel level, above anything TI (PowerRun or whatever can do).

Click to expand...

No, my only desire was to import defender service key so it to run. If it is already running (restored by the Security service) there is no point.

The current issue is that the package Microsoft.SecHealthUI_1000.27703.1006.0_x64__8wekyb3d8bbwe.appx when I install it does not create C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy folder, which seems wrong. First time it worked well.

garlin said:

Did the C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy folder disappear?

Click to expand...

So, I rolled the system back, now it seems, no Defender or Security Health Service are running. When I install the appx package, the folder Microsoft.SecHealthUI_1000.27703.1006.0_x64__8wekyb3d8bbwe.appx is still not created... Why?

Sorry, it's "\Program Files\WindowsApps" for SecHealthUI.

garlin said:

Sorry, it's "\Program Files\WindowsApps" for SecHealthUI.

Click to expand...

Ah. So, the problem is simple: blank screen unlike the first time when it worked.

To sum it up:

1. The first time it worked:
* I did it before the update to the recent patches
* I ran appx package, it installed
* Then I run RunAsTI, imported Defender service reg settings, they imported successfully
* Then I enabled services SecurityHealthService and SecurityHost.
* The app started and worked.

2. Now:
* I cannot roll back before the update for the last 7 months, but can roll back to when Defender and SecurityHealth are disabled
* I run the appx package, it seemingly installs
* Then I run RunAsTI to import Defender service settings, but it reports access rights violation and does not import, even though the Defender service is not running. After this, UAC starts to pop up everywhere (UAC was at lowest level, that is, only UAC icons on buttons, but becomes above the lowest)
* Then I enable SecurityHealthService and SecurityHost.
* After they are enabled, over some time Defender starts as well, and its service registry entry automatically appears.
* The Windows Security app is still blank, even though all the 3 services are running.

Your OS version is simply Windows 11. That tells us nothing to help you.
If you really want help, then you need to tell us more about your computer and what version you started with when it was bought or when you acquired it.

You don't need to start new topics on this same subject!

Jacee said:

Your OS version is simply Windows 11. That tells us nothing to help you.
If you really want help, then you need to tell us more about your computer and what version you started with when it was bought or when you acquired it.

You don't need to start new topics on this same subject!

Click to expand...

In the first post I said: Win11 23H2.

Build number is 4890 (after update). When the topic was created, the build number was around 3500