Windows Defender Antivirus Network Inspection Service issues since Windows 10 2004 update

Anonymous
2020-08-06T08:15:09+00:00

I got the 2004 update yesterday and that went well enough otherwise but I am having a problem with the Windows Defender Antivirus Network Inspection Service that I did not have previously. 

  1. I noticed in Event Viewer several Errors that began immediately upon completion of the update last night: 

The Microsoft Defender Antivirus Network Inspection Service service depends on the Microsoft Defender Antivirus Network Inspection System Driver service which failed to start because of the following error: 

The supplied user buffer is not valid for the requested operation.

  1. Further inspection has revealed that there is now a problem with Real Time Updates. 

Microsoft Defender Antivirus Real-Time Protection feature has encountered an error and failed.

  Feature: Network Inspection System

Error Code: 0x8007042c

Error description: The dependency service or group failed to start. 

Reason: The system is missing updates that are required for running Network Inspection System.  Install the required updates and restart the device.

I've got this error repeatedly (3002). 

  1. I went into security and maintenance to see what was going on with my security settings. That is not showing anything "wrong." 
  2. The Network Inspection Service is configured to manual, not automatic. I can't change this. 
  3. Real-time protection is on, and has been on. On Virus & threat protection settings, all of those are still toggled on, and those settings are the same before and after the upgrade. I haven't tried turning them on and off again yet. 
  4. I already did the August Safety scan, but I downloaded a fresh copy and am re-running it. 
  5. I did dism and sfc checks and they showed no problems that needed repair. 

Something is definitely wrong with the install of Windows Defender tho... Help? How do I fix this and stop the errors and get it reconfigured properly. Do I have to reinstall it?

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

95 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Anonymous
    2020-08-08T12:24:13+00:00

    I dont know how the Independent Advisor program works, but if it is possible for you to escalate this issue within Microsoft or the Windows Security team then could you please do that?

    It is amazing to me that they allowed an update to Defender to get pushed to the public channel that is incompatible with another key security feature in Windows.

    This needs fixed immediately.

    Thanks

    Was this answer helpful?

    0 comments
  2. Anonymous
    2020-08-08T12:21:18+00:00

    The issue seems to be with the latest publicly pushed Defender Platform update. At least one user on another forum reported the issue on 1909 but with the latest Defender platform.

    When you attempt to turn Memory Integrity back on and get the error that it cannot start due to an incompatibility, there should be a new link under the toggle that you can click and it will tell you what is causing the incompatibility. I get the same error when toggling it on my desktop, but in my case it is caused by a conpletely extraneous and unnecessary driver for an external WD hdd. I can delete that driver and toggle it on, but of course then NIS breaks.

    Was this answer helpful?

    0 comments
  3. Anonymous
    2020-08-08T11:23:37+00:00

    Hi,

    I'm glad you figured out the issue and thank you for posting the details & I'm sure it will help others who are having the error with respect to NIS in event viewer.

    Let me know anything else I can assist you with.

    Regards

    Shuaib

    Independent Advisor

    Was this answer helpful?

    0 comments
  4. Anonymous
    2020-08-08T09:10:01+00:00

    Well... I am wrong in my assessment of things. I had been up too many hours yesterday after rebuilding my dead machine, and my eyes skipped past the text on Core Isolation without reading it word for word. 

    I went back in to check every little minute detail... setting by setting, during the rebuilding process, and sure enough... Core Isolation is turned off. 

    And I can't get it to turn itself back on again even to see if this breaks NIS in Defender. 

    The error I get is 

    "Memory Integrity can't be started.

    There may be an incompatibility on your device." 

    Well yes... based on what I understand now, there is. :P If I turn it on, NIS will break (and who knows what else). 

    I went in to see what updates Windows Update would pick up ... and it is the 2004 update next, not the 2020-07 Optional 1909 update which is what it wanted to hand me before I logged last time. 

    So I guess I get to have core isolation off (yes, I checked BIOS settings and UEFI etc. it's all set how it should be). 

    Too bad I can't go back in time 36 hours and turn off core isolation :P

    Was this answer helpful?

    0 comments
  5. Anonymous
    2020-08-08T08:00:47+00:00

    Hi Shuaib, 

    Thanks for the reply. 

    I did indeed go to revert to a prior version of windows, and it ... failed. Hard. System would not boot. 

    So I had to reset the PC. 

    I have updated the OS to a point where I can use core isolation/VBS and Windows Security is functioning properly. I don't know how far I can upgrade the OS before something breaks, because I don't know if the problem was introduced at some latter 1909 patch or a part of 2004. 

    As mentioned elsewhere, I never would have updated to 2004 if the release had not been out for a while, and I did come to the answers forum to search for issues people had encountered. Nothing like this was mentioned, but I imagine a lot of casual users are not going into Event Viewer after an update to see what issues arose with the update, or reviewing any changes in the status of services running.

    And a friend pointed out somewhat glibly, they didn't see this issue because they use a different antivirus solution for real-time AV. That handily circumvents this entire issue.

    Was this answer helpful?

    0 comments