Split from this thread . Hi Frank, If you wish to fix Windows Security, please start a new thread and post the following logs. Post the link to the new thread here. Step 1: Download Farbar Recovery Scan Tool (FRST64.exe). [See also: Collect Farbar Recovery Scan Tool logs .] Rename FRST64.exe to EnglishFRST64.exe. Run EnglishFRST64.exe. Don't check or uncheck any options. Click "Scan". Upload the two logs, FRST.txt and Addition.txt, to your OneDrive and share the link here. Step 2: Download defender_diag.bat . Right-click on the file, click Properties, Unblock, and OK. Run the batch file as administrator. (The Batch file queries Defender-related settings/Policies and outputs the results to a log file named defender.log. Upload this log to your OneDrive and share the link here.) (How-To: Share OneDrive files and folders - Microsoft Support )

//Does this makes sense, to analyse, or would you suggest a different scenario?// Yes. That should also work. Please zip the PML before sharing.

Hi Ramesh, Hi Frank, I read a bit about procmon trace, it seems to be a debug program to collect data, where you can clear the data, then start a recording and log the data of events. It seems you can download procmon somewhere on the windows site, install it and with some Control Commands, you can clear, start and stop the recording? Which would be the best scenario to record. Launch services in the search bar scroll down to Windows Security Start the Service, which results in this error: close the services Stop recording. Does this makes sense, to analyse, or would you suggest a different scenario?

The Platform folder is found, and the service is intact, yet the service fails to start. Frank faces exactly the same issue. A ProcMon trace from one of the two systems might help.

Hi Ramesh, Thanks again for looking into this. I downloaded and ran the batch file. It showed the log in the notes app, however the defender.log was not created. I saved the log shown in the notes app as defender.log and uploaded it to here: https://1drv.ms/f/s!At3helIxGZsEknlHW5PQcVhJDUtO?e=8UqqhV

Windows Security Windows only shows Shield Icon

Anonymous

Split from this thread.

Hi Frank,

If you wish to fix Windows Security, please start a new thread and post the following logs. Post the link to the new thread here.

Step 1:

Download Farbar Recovery Scan Tool (FRST64.exe). [See also: Collect Farbar Recovery Scan Tool logs.]
Rename FRST64.exe to EnglishFRST64.exe.
Run EnglishFRST64.exe. Don't check or uncheck any options. Click "Scan".
Upload the two logs, FRST.txt and Addition.txt, to your OneDrive and share the link here.

Step 2:

Download defender_diag.bat. Right-click on the file, click Properties, Unblock, and OK. Run the batch file as administrator.

(The Batch file queries Defender-related settings/Policies and outputs the results to a log file named defender.log. Upload this log to your OneDrive and share the link here.)

(How-To: Share OneDrive files and folders - Microsoft Support)

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

Those entries have no significance. Those entries show up in my system as well. You'll see a lot of Not Found entries for any operation you do. Usually, most of those entries have no significance.

You may try this if possible.

Download this REG file and save it to a folder named c:\reg\

Launch AdvancedRun (from Nirsoft) and start cmd.exe as TrustedInstaller.

In the TrustedInstaller Command Prompt, run:

reg.exe import c:\reg\securityhealth.reg
exit

This restores some essential registry keys used by Defender.

0 comments

94 additional answers

Anonymous

2023-12-27T09:44:10+00:00

//Does this makes sense, to analyse, or would you suggest a different scenario?//

Yes. That should also work. Please zip the PML before sharing.
Was this answer helpful?

0 comments No comments
Anonymous

2023-12-27T09:41:18+00:00
Hi Ramesh, Hi Frank,

I read a bit about procmon trace, it seems to be a debug program to collect data, where you can clear the data, then start a recording and log the data of events. It seems you can download procmon somewhere on the windows site, install it and with some Control Commands, you can clear, start and stop the recording?

Which would be the best scenario to record.
- Launch services in the search bar
- scroll down to Windows Security
- Start the Service, which results in this error:
- close the services
- Stop recording.
Does this makes sense, to analyse, or would you suggest a different scenario?
Was this answer helpful?

0 comments No comments
Anonymous

2023-12-26T13:17:06+00:00

The Platform folder is found, and the service is intact, yet the service fails to start. Frank faces exactly the same issue. A ProcMon trace from one of the two systems might help.
Was this answer helpful?

0 comments No comments
Anonymous

2023-12-26T12:47:54+00:00

Hi Ramesh, Thanks again for looking into this.

I downloaded and ran the batch file. It showed the log in the notes app, however the defender.log was not created.

I saved the log shown in the notes app as defender.log and uploaded it to here: https://1drv.ms/f/s!At3helIxGZsEknlHW5PQcVhJDUtO?e=8UqqhV
Was this answer helpful?

0 comments No comments