Author Topic: Windows Defender Won't Turn Off After Running Repair (Read 27881 times)

Mighty Joe · « **Reply #25 on:** August 12, 2016, 08:40:05 am »

@Boggin

With the recent responses, I just wanted to make sure my original request in Reply #11 wasn't forgotten. Please let me know when you have a chance. Thanks again.

Boggin · « **Reply #26 on:** August 12, 2016, 12:56:48 pm »

I've sent Shane another email with a link to your thread.

Boggin · « **Reply #27 on:** September 25, 2016, 03:49:01 pm »

In response to your PM I emailed Shane and he has suggested that you run his Technicians Toolbox - open services - go to the service and right click on it and set the full permissions for it.

You can also do this for any of the other services that are greyed out.

In the left pane at www.tweaking.com click on Tweaking.com Programs and the link is at the bottom of the list.

Mighty Joe · « **Reply #28 on:** September 25, 2016, 04:30:21 pm »

Thanks for the quick reply. I'll give that a try as soon as I can and report back.

Mighty Joe · « **Reply #29 on:** September 26, 2016, 09:27:38 am »

I hit full permissions on WinDefend and the others I noted. Nothing happened. I rebooted and there was no change to the status of those services. Please advise. Thanks.

Boggin · « **Reply #30 on:** September 26, 2016, 09:50:54 am »

I'll pass it on.

Boggin · « **Reply #31 on:** September 26, 2016, 10:45:12 am »

Shane's response so far was to use gpedit if you had Win 10 Pro but I've told him you are using Win 10 Home - otherwise what he first suggested with Technicians Toolbox had always worked for him.

Waiting for another reply but I'm going to have to shove off for a while.

Mighty Joe · « **Reply #32 on:** September 26, 2016, 04:10:31 pm »

Under "Services - All Tasks", there is an option for "change startup type." Should I try that? Seems logical to me but I wanted to verify it is safe to try.

Boggin · « **Reply #33 on:** September 26, 2016, 05:03:31 pm »

Mine is set to Manual and when I've checked its Properties, its Startup type is greyed out, but I have Norton Security installed on mine which would have disabled it anyway.

What did the tech shop do to resolve it ?

WR resets the Services to default, but there doesn't appear to be an answer as to why it's frozen, unless as it is the only AV program you have then perhaps Windows had decreed that you cannot stop or change its start up.

I think you may have perform a repair install to resolve this if that isn't the case, although installing a 3rd party AV program may change its status as when one is installed, that would disable it.

For the repair install, if you don't have a Win 10 install disk or USB then you can create one by using the Download tool now button in https://www.microsoft.com/en-gb/software-download/windows10 and read the instructions for use the tool to create installation media.

When done, open Windows Explorer, click on This PC - stick the disk in and hit the Setup.exe

This won't affect your personal files or any programs you have installed.

Mighty Joe · « **Reply #34 on:** September 26, 2016, 05:47:44 pm »

I don't know what my tech shop did the first time to get me back up and running.

Prior to running WR, WD was disabled and I was able to enable/disable it at will. Let's be clear: Tweaking.com Windows Repair changed this setting in my Windows Defender and the other services I mentioned, not my antivirus or anything else. Even though it says it's running in my Task Manager Service settings, I'm getting notifications from Windows Action Center that WD actually is not running so who the hell knows.

I'm not doing a repair install and I think I've learned my lesson about using Tweaking.com in the future. It's crazy that this happens to me and you guys won't/can't provide a solution. That's weak customer service. It's even crazier that I brought this problem with the program to your guys' attention and that it wasn't addressed.

I'll say it again: Your program should not leave the user unable to change settings of Windows services.

I'll fend for myself. Sorry to have bothered you guys.

Boggin · « **Reply #35 on:** September 27, 2016, 01:26:27 am »

First of all, I'm just an ordinary member who has been elevated to Mod status to help out and have nothing to do with how the program runs which way or ever.

On the odd occasion when the program causes a problem, it can be machine specific.

I can't run it on one of my laptops because it causes it to freeze after the reboot and even after subsequent reboots - cause unknown and it could be that the cause of your problem could also be unknown.

I had to boot into Safe Mode to run the program and use Option 5 to restore the registry to get things back to normal.

I didn't have a reason to run the program except out of curiosity to see if it did find anything.

I know someone on another forum who is a professional computer tech who swears by it and has run it on many a computer to fix problems without complaint.

As for your problem not being addressed, Shane has offered one solution which had always worked for him.

I've passed onto Shane what you have told me and asked if there's an alternative to the Tool box and I'm awaiting a reply to see if he comes up with something, which I'll relay to you via this thread, unless Shane responds direct.

Mighty Joe · « **Reply #36 on:** September 27, 2016, 06:42:43 am »

I realize you are a just a moderator so that's why I tried to be careful in my language to not imply you were Shane's partner or a co-developer of the program. I apologize if I failed there. I'm just extremely frustrated. However I stand by everything I said especially that there has to be some kind of actual solution (e.g. a change to specific registry keys or command script) rather than a repair install.

Let me also add that I tried the "change startup type" option and got the error "there was a problem setting the service startup type for WinDefend - error: 2 - the user did not have the necessary access." So I conclude that instead of maintaining my permissions for certain key services like WD, WR actually took them away. I wanted to let you know this in case it helps narrow down what could have gone awry.

I did not run Technician's Toolbox in safe mode with networking like I did with WR. Do you feel that would make a difference?

Thanks

Boggin · « **Reply #37 on:** September 27, 2016, 07:31:20 am »

As far as I'm aware the Tool Box can be run in either mode, but I'll ask Shane to see if he has any other ideas in how to solve your problem.

I'm not sure if activating the hidden admin account and then use the Tool Box to see if you can change the permissions or startup type have any more success, but you could try.

Open a Command Prompt (Admin) and enter -

net user administrator /active:yes

shutdown /r /t 00

and after the reboot, click on the Admin icon and wait for it to rearrange the desktop.

When done, repeat the command, changing yes to no as it shouldn't be enabled all of the time.

For me, I would have run a repair install - some things may not have a standard solution and it's not known why the program would have that effect on your machine.

Anyway, I'll give Shane an email Bump.

Mighty Joe · « **Reply #38 on:** September 27, 2016, 09:07:38 am »

Doing a repair install with installation media would be my absolute last resort.

What about an in-place repair install or system restore?

Tried running TT in safe mode with networking and it didn't work. Same result as before.

Tried your suggestion of enabling the hidden administrator and that didn't work either. Same result as before.

I checked the executable path of WD (msmpeng.exe) and it shows Trusted Installer as having full control and Administrators, SYSTEM, Users, ALL APPLICATION PACKAGES, and ALL RESTRICTED APPLICATION PACKAGES as having only read & execute.

Is it possible to for me (Administrators) to take ownership of WD manually or would the current policies deny me?

Boggin · « **Reply #39 on:** September 27, 2016, 09:16:53 am »

You could try giving permission to Everyone temporarily but sticking the disk in while in Windows is an in place repair.

It doesn't affect personal files or installed programs.

If System Protection is enabled and you have a restore point after the tech fixed it but before you ran WR, that should work, but from what you've said, I doubt that Windows will have had time to create an auto one, but you could check.

Haven't heard anything back from Shane yet, although it's only about 09:15am for him and I know he's been working hard on the next release of WR.

Boggin · « **Reply #40 on:** September 27, 2016, 09:24:02 am »

I think Everyone has to be typed in all uppercase.

Mighty Joe · « **Reply #41 on:** September 27, 2016, 09:29:01 am »

Honestly I'm kind of afraid to try manually changing permission of services without a step-by-step walkthrough and I understand what Shane is working on is highest priority so getting a reply from him soon is probably unlikely.

I think I'm going to try system restore in safe mode. I have a restore point saved on 9/21, a few days before my problem, so in theory there's a good chance that will work. I'll let you know how I do.

Boggin · « **Reply #42 on:** September 27, 2016, 09:30:59 am »

Okay - Good Luck.

Mighty Joe · « **Reply #43 on:** September 27, 2016, 09:22:50 pm »

Through research I was able to find a way to override WD being enabled permanently without using system restore. It's now disabled as I wanted it. I wasn't able to find a similar fix for the other services I mentioned but I'm not that concerned about those, at least not right now. Unfortunately, however, it looks like I'm still going to get notifications about WD being off (PC status: At risk) in the lower right corner of my monitor because the Enhanced Notifications option (under Settings) is greyed out so that it can't be turned off. I would ask you where to look in my registry or elsewhere to try and fix that but you'll never get an reply from Shane so no point in my asking.

I don't mean to beat a dead horse but it sounds like Shane doesn't think what happened to me (twice) is a result of a bug in his program and that it's just some weird thing that only affected one individual's machine (mine) for some unexplained reason, is that about right? No one else has ever reported this problem? I mean, a user not being able to disable WD has potential major repercussions as far as conflicts with their commercial antivirus, leaving them open to viruses, I would think.

Boggin · « **Reply #44 on:** September 28, 2016, 12:40:58 am »

Shane is obviously tied up as he was planning to release the updated WR on Monday, but besides WR he also has a computer business to run and if he gets a few jobs in at the same time, then they will take all precedence.

Regardless of what caused your problem, without a positive fix at this time, I would still go back to scratch and perform a repair install as I've described.

Before running a program like WR which can make major changes to your system, I've always created a system image onto external media, so if something should go wrong, I always have a fall back.

That is why Shane is insistent that you back up the registry before proceeding with the repairs.

Even if you hadn't manually backed up the registry first, the program should have and I think you should check Option 5 and use the registry restore.

The dropdown is usually blank but clicking on the arrow will give the back ups that have been created so that you can use whichever, but only go back as far as the pre-WR you ran last time and hopefully that will resolve all of the services problems.