Windows Defender Antivirus Network Inspection Service issues since Windows 10 2004 update

The issue seems to be with the latest publicly pushed Defender Platform update. At least one user on another forum reported the issue on 1909 but with the latest Defender platform.

When you attempt to turn Memory Integrity back on and get the error that it cannot start due to an incompatibility, there should be a new link under the toggle that you can click and it will tell you what is causing the incompatibility. I get the same error when toggling it on my desktop, but in my case it is caused by a conpletely extraneous and unnecessary driver for an external WD hdd. I can delete that driver and toggle it on, but of course then NIS breaks.

Hi,

I'm glad you figured out the issue and thank you for posting the details & I'm sure it will help others who are having the error with respect to NIS in event viewer.

Let me know anything else I can assist you with.

Regards

Shuaib

Independent Advisor

Well... I am wrong in my assessment of things. I had been up too many hours yesterday after rebuilding my dead machine, and my eyes skipped past the text on Core Isolation without reading it word for word. 

I went back in to check every little minute detail... setting by setting, during the rebuilding process, and sure enough... Core Isolation is turned off. 

And I can't get it to turn itself back on again even to see if this breaks NIS in Defender. 

The error I get is 

"Memory Integrity can't be started.

There may be an incompatibility on your device." 

Well yes... based on what I understand now, there is. :P If I turn it on, NIS will break (and who knows what else). 

I went in to see what updates Windows Update would pick up ... and it is the 2004 update next, not the 2020-07 Optional 1909 update which is what it wanted to hand me before I logged last time. 

So I guess I get to have core isolation off (yes, I checked BIOS settings and UEFI etc. it's all set how it should be). 

Too bad I can't go back in time 36 hours and turn off core isolation :P

Hi Shuaib, 

Thanks for the reply. 

I did indeed go to revert to a prior version of windows, and it ... failed. Hard. System would not boot. 

So I had to reset the PC. 

I have updated the OS to a point where I can use core isolation/VBS and Windows Security is functioning properly. I don't know how far I can upgrade the OS before something breaks, because I don't know if the problem was introduced at some latter 1909 patch or a part of 2004. 

As mentioned elsewhere, I never would have updated to 2004 if the release had not been out for a while, and I did come to the answers forum to search for issues people had encountered. Nothing like this was mentioned, but I imagine a lot of casual users are not going into Event Viewer after an update to see what issues arose with the update, or reviewing any changes in the status of services running.

And a friend pointed out somewhat glibly, they didn't see this issue because they use a different antivirus solution for real-time AV. That handily circumvents this entire issue.

So, ignoring the "reset windows" suggestion because...yeah, not doing that...I tried an in-place upgrade and upon initial boot the behavior was gone. However, upon reboot it returned. I gave up for yesterday and went to sleep.

I woke up this morning and decided to try turning off Core Isolation/Virtualization Based Security. That fixed it; Microsoft Defender Antivirus Network Inspection Service now starts and runs without complaint. Apparently Microsoft messed up an update to Defender or something else and caused this to start happening; it's not like this is the first time they have deployed a broken Defender update.

Do you have Core Isolation/VBS enabled, khynnea?

---

Edit: Verified repeatable resolution on a second machine; my Windows 10 Home 2004 laptop.

Thank you so much for this insight and troubleshooting.

I do indeed have core isolation/VBS enabled. And I literally never would have thought to try this because this is one thing I would never turn off on my machine. 

And it honestly boggles my mind that there would be such a fatal flaw between the realtime antivirus inspection service and a core security feature... meh. With this bug, the service isn't running but there is no indication that it is not running from the main Windows Security UI, no indication that there is a problem in the registry. And multiple 3rd party antivirus scans turned up no issue. So either something -really- seriously wrong is present or it just happened to coincide with the 2004 upgrade. 

To be fair, the recent Defender update that was pushed a few days prior could have been the culprit and not the 2004 build. I'm absolutely hate troubleshooting windows anything. 

Someone with access to 1903, 1909, 2004 builds would have to point to where the problem is, and whether it is part of 2004 or Defender. 

Thank you so much for the peace of mind your troubleshooting discovery brings.