Split from this thread . Hi Frank, If you wish to fix Windows Security, please start a new thread and post the following logs. Post the link to the new thread here. Step 1: Download Farbar Recovery Scan Tool (FRST64.exe). [See also: Collect Farbar Recovery Scan Tool logs .] Rename FRST64.exe to EnglishFRST64.exe. Run EnglishFRST64.exe. Don't check or uncheck any options. Click "Scan". Upload the two logs, FRST.txt and Addition.txt, to your OneDrive and share the link here. Step 2: Download defender_diag.bat . Right-click on the file, click Properties, Unblock, and OK. Run the batch file as administrator. (The Batch file queries Defender-related settings/Policies and outputs the results to a log file named defender.log. Upload this log to your OneDrive and share the link here.) (How-To: Share OneDrive files and folders - Microsoft Support )

No. The "Windows Security Service" event is not logged. Also, please zip the PML.

The Logfile for the PML is here https://1drv.ms/f/s!At3helIxGZsEknlHW5PQcVhJDUtO?e=jTQEoN This recorded only the production of the error, going to services.msc, scroll to Windows Security, double click and try to start the service. The process on the internet described how to start and stop the procmon was differen than the version downloaded, so I do hope the log file logged the event sequence, if not, let me know, I can try again, of if you have another link to the procmon, let me know. I noticed there is an option to create a bootlog with procmon, if that can be usefull let me know.

//Does this makes sense, to analyse, or would you suggest a different scenario?// Yes. That should also work. Please zip the PML before sharing.

Hi Ramesh, Hi Frank, I read a bit about procmon trace, it seems to be a debug program to collect data, where you can clear the data, then start a recording and log the data of events. It seems you can download procmon somewhere on the windows site, install it and with some Control Commands, you can clear, start and stop the recording? Which would be the best scenario to record. Launch services in the search bar scroll down to Windows Security Start the Service, which results in this error: close the services Stop recording. Does this makes sense, to analyse, or would you suggest a different scenario?

Windows Security Windows only shows Shield Icon

Anonymous

Split from this thread.

Hi Frank,

If you wish to fix Windows Security, please start a new thread and post the following logs. Post the link to the new thread here.

Step 1:

Download Farbar Recovery Scan Tool (FRST64.exe). [See also: Collect Farbar Recovery Scan Tool logs.]
Rename FRST64.exe to EnglishFRST64.exe.
Run EnglishFRST64.exe. Don't check or uncheck any options. Click "Scan".
Upload the two logs, FRST.txt and Addition.txt, to your OneDrive and share the link here.

Step 2:

Download defender_diag.bat. Right-click on the file, click Properties, Unblock, and OK. Run the batch file as administrator.

(The Batch file queries Defender-related settings/Policies and outputs the results to a log file named defender.log. Upload this log to your OneDrive and share the link here.)

(How-To: Share OneDrive files and folders - Microsoft Support)

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

Those entries have no significance. Those entries show up in my system as well. You'll see a lot of Not Found entries for any operation you do. Usually, most of those entries have no significance.

You may try this if possible.

Download this REG file and save it to a folder named c:\reg\

Launch AdvancedRun (from Nirsoft) and start cmd.exe as TrustedInstaller.

In the TrustedInstaller Command Prompt, run:

reg.exe import c:\reg\securityhealth.reg
exit

This restores some essential registry keys used by Defender.

0 comments

94 additional answers

Anonymous

2023-12-27T13:17:45+00:00

No. The "Windows Security Service" event is not logged. Also, please zip the PML.
Was this answer helpful?

0 comments No comments
Anonymous

2023-12-27T13:14:01+00:00

The Logfile for the PML is here https://1drv.ms/f/s!At3helIxGZsEknlHW5PQcVhJDUtO?e=jTQEoN This recorded only the production of the error, going to services.msc, scroll to Windows Security, double click and try to start the service.

The process on the internet described how to start and stop the procmon was differen than the version downloaded, so I do hope the log file logged the event sequence, if not, let me know, I can try again, of if you have another link to the procmon, let me know.

I noticed there is an option to create a bootlog with procmon, if that can be usefull let me know.
Was this answer helpful?

0 comments No comments
Anonymous

2023-12-27T09:44:10+00:00

//Does this makes sense, to analyse, or would you suggest a different scenario?//

Yes. That should also work. Please zip the PML before sharing.
Was this answer helpful?

0 comments No comments
Anonymous

2023-12-27T09:41:18+00:00
Hi Ramesh, Hi Frank,

I read a bit about procmon trace, it seems to be a debug program to collect data, where you can clear the data, then start a recording and log the data of events. It seems you can download procmon somewhere on the windows site, install it and with some Control Commands, you can clear, start and stop the recording?

Which would be the best scenario to record.
- Launch services in the search bar
- scroll down to Windows Security
- Start the Service, which results in this error:
- close the services
- Stop recording.
Does this makes sense, to analyse, or would you suggest a different scenario?
Was this answer helpful?

0 comments No comments