Windows Defender Antivirus Network Inspection Service issues since Windows 10 2004 update

Thanks for the reply.

I've gone through the article linked, and checked all the registry entries.

All the start types were validated and correct.

I am still getting errors in Event Viewer. Something is wrong somewhere and I am more suspicious of the 2004 udpate.

I've located the WdNisDrv  Microsoft Defender Antivirus Network Inspection System Driver as a result of the registry entry and it showing me where to find the file -- but this service isn't listed in services. Should it be?

I went through the dependencies on the services  tab for WdNisSvc and checked all of them. WdNisDrv is just not listed in the services.msc pane unless it's under a name I can't locate.

Here is more detailed information about the errors.

Still seeing

The Microsoft Defender Antivirus Network Inspection Service service depends on the Microsoft Defender Antivirus Network Inspection System Driver service which failed to start because of the following error:

The supplied user buffer is not valid for the requested operation.

What is "user buffer not valid" ?? How do I address this.

Is this the missing WdNisDrv / driver?

Going to try to simplify the status of this issue: 

Everything seems to be working alright except real time inspection.

Microsoft Defender Antivirus Real-Time Protection feature has encountered an error and failed.

  Feature: Network Inspection System

  Error Code: 0x8007042c

  Error description: The dependency service or group failed to start. 

  Reason: The system is missing updates that are required for running Network Inspection System.  Install the required updates and restart the device.

* The files for the Network Inspection Service driver appear to be where they belong. 

* dism and scf have been run repeatedly and nothing is missing, not having issues with windows update -- that is grabbing antivirus definitions ok too. 

* Network Inspection Service Driver is not showing in services if it should be.

It is showing as a dependency; the icon is different so maybe it isn't a service. All the other services that show as dependencies are there and are running fine (Base Filtering Engine, Remote Procedure Call (RPC), DCOM server Process Launcher, RPC Endpoint Manager) . 

* When I try to manually start the service via services.msc I get error 1068 / The dependency service or group failed to start. 

* The path info for WdNisDrv.sys is 

system32\drivers\wd\WdNisDrv.sys

in regedit. 

The file is physically in the location 

C:\Windows\System32\drivers\wd

Wondering how to approach this if it is a configuration issue.

I am seeing this same behavior; also on 2004.

Hi,

There is an issue with the update as I one more user having the same issue after the update so to resolve this I suggest you follow the below or wait for the next release of updates to see if it fixes the issue.

Reference :

https://www.reddit.com/r/Windows10/comments/hz2...

Fix #1

Step 1:

On the login screen click on Power icon on the right corner

Step 2:

Press Shift Key and press hold and then click Restart (This will restart the system in recovery mode)

Step 3:

In the recovery bluescreen options you’ll need to click (or tap) the Troubleshoot option

Step 4:

Then click on Refresh your PC (Selecting this option keeps data and Windows default programs safe but the programs which you have downloaded and installed or from CD/DVD needs to be re-installed)

Let me know if anything else I can assist you with.

Regards

Shuaib

Independent Advisor

So, ignoring the "reset windows" suggestion because...yeah, not doing that...I tried an in-place upgrade and upon initial boot the behavior was gone. However, upon reboot it returned. I gave up for yesterday and went to sleep.

I woke up this morning and decided to try turning off Core Isolation/Virtualization Based Security. That fixed it; Microsoft Defender Antivirus Network Inspection Service now starts and runs without complaint. Apparently Microsoft messed up an update to Defender or something else and caused this to start happening; it's not like this is the first time they have deployed a broken Defender update.

Do you have Core Isolation/VBS enabled, khynnea?

Edit: Verified repeatable resolution on a second machine; my Windows 10 Home 2004 laptop.