windows defender fails to operate

Question

windows defender fails to operate

anurag 0

Microsoft Defender Quick Scan fails with 0x800106ba even though Defender is running

Hi,

I am having an issue with Microsoft Defender Antivirus on my Windows PC.

Windows Security shows “Threat service has stopped” and Quick Scan is unavailable/fails. However, when I check Defender through Administrator PowerShell, Defender appears to be enabled and running normally.

Problem

Both of the following Defender scan methods fail with the same error:

Start-MpScan -ScanType QuickScan

Result:

Start-MpScan : Errors were encountered when attempted to scan your device.
FullyQualifiedErrorId : HRESULT 0x800106ba,Start-MpScan

I also tested Microsoft's Defender command-line scanner:

& "$env:ProgramFiles\Windows Defender\MpCmdRun.exe" -Scan -ScanType 1

It reports:

Scan starting...
ScanType 1 started.
...
hr=0x800106ba
CmdTool: Failed with hr = 0x800106ba.

The MpCmdRun.log shows:

Starting RunCommandScan.
Start: MpScan(MP_FEATURE_SUPPORTED, scanType=1, ...)
MpScan() started
MpScan() was completed
...
ERROR: MpScan(dwOptions=1073758209) Completion Failed 0x800106ba
MpCmdRun.exe: hr = 0x800106ba.

Defender status

Get-MpComputerStatus reports:

AMServiceEnabled          : True
AntivirusEnabled          : True
RealTimeProtectionEnabled : True
AMRunningMode             : Normal
IsTamperProtected         : True

The Defender service also reports:

Name       Status  StartType
----       ------  ---------
WinDefend  Running Automatic

Other checks performed

There is no third-party antivirus registered with Windows Security:

displayName
-----------
Windows Defender

Windows Update reports that the PC is up to date.

I ran:

DISM /Online /Cleanup-Image /RestoreHealth

DISM reported that the restore operation completed successfully and repaired the component store.

I then ran:

sfc /scannow

SFC reported:

Windows Resource Protection did not find any integrity violations.

I also ran:

Update-MpSignature

which completed successfully. Defender's current security intelligence is:

AntivirusSignatureVersion: 1.457.227.0
AntivirusSignatureLastUpdated: 18-08-2026

I also confirmed these registry values are not disabling Defender:

DisableAntiSpyware : 0
DisableAntiVirus   : 0

What is confusing

Defender's real-time protection appears to be working normally, and the Defender service is running, but both PowerShell Start-MpScan and MpCmdRun.exe fail when an actual Quick Scan is started with HRESULT 0x800106ba.

I would like to know what could cause the Defender scan engine to return 0x800106ba while WinDefend is running and RealTimeProtectionEnabled is True.

What diagnostic or repair steps should I take next?

Thank you.

0 comments

1 answer

Your answer

Answer 1

0x800106BA is documented as a Microsoft Defender Antivirus service-disabled error. Since WinDefend shows as running in the current session, the next step is to verify the full Defender service and driver stack, then review Defender operational scan events, and if needed reset the Defender platform/components.

Verify all Defender-related services and drivers, not just WinDefend.

Run this in an elevated PowerShell window:

Get-Service WinDefend, WdBoot, WdFilter, WdNisSvc, WdNisDrv, SecurityHealthService, wscsvc | Format-Table -Auto DisplayName, Name, StartType, Status

Expected states from Microsoft documentation:

WinDefend = Automatic, Running
WdFilter = Boot, Running
WdNisDrv = Manual, Running
WdNisSvc = Manual, Running
SecurityHealthService = Manual, Running
wscsvc = Automatic, Running
WdBoot can be Stopped after boot

If WdFilter, WdNisDrv, WdNisSvc, or WinDefend are stopped, that aligns with Defender startup problems even if Get-MpComputerStatus still reports enabled features.

Review Defender operational logs for scan failures.

In Event Viewer, check:

Application and Service Logs > Microsoft > Windows > Windows Defender > Operational

Or use PowerShell:

Get-WinEvent -LogName 'Microsoft-Windows-Windows Defender/Operational'

To focus on scan events:

Get-WinEvent -LogName 'Microsoft-Windows-Windows Defender/Operational' | where id -eq '1000'

This is the best next diagnostic step for a case where scan initiation fails but real-time protection appears active.

Confirm the scan is being launched from a valid MpCmdRun.exe location.

MpCmdRun is not intended to be run from an arbitrary path. Microsoft recommends running it from the latest Defender platform folder under:

%ProgramData%\Microsoft\Windows Defender\Platform\<antimalware platform version>
fallback: %ProgramFiles%\Windows Defender

If needed, switch to the current platform folder first in an elevated Command Prompt, then run the scan.

If the service stack looks wrong, use the documented Defender service-startup recovery steps.

Microsoft’s documented sequence includes:

uninstall any non-Microsoft antivirus if Defender is intended to be the primary antivirus
remove Security Intelligence and engine files:

MpCmdRun.exe -RemoveDefinitions -All

reset the Defender platform:

MpCmdRun.exe -ResetPlatform

Risk: these actions reset Defender components and temporarily remove definitions until they are restored. Run them only from an elevated Command Prompt.

If local Defender policies are present and incorrect, back them up before removal.

Microsoft documents backing up Defender policy registry settings first, then removing Defender policy keys if they are causing startup problems.

Backup:

New-Item -Path "C:\DefenderTemp" -ItemType Directory; Invoke-Command {reg export 'HKLM\SOFTWARE\Policies\Microsoft\Windows Defender' C:\DefenderTemp\_DefenderAVBackup.reg}

Remove policy key:

Remove-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Force

Risk: deleting Defender policy keys changes security configuration. Back up first.

After any reset, update Defender again and retest the scan.

The documented cmdlet for updating security intelligence is:

Update-MpSignature

Then retry:

Start-MpScan -ScanType QuickScan

If scan errors continue, run Windows Update and consider manual protection updates.

Microsoft support guidance for repeated Defender scan/update errors is to run Windows Update and, if update-related issues persist, try installing the latest protection updates manually.

Given the symptoms, the most likely supported interpretation is: the scan path is failing because part of the Defender service/driver/platform stack is unhealthy even though WinDefend, real-time protection, and status cmdlets still appear normal. The highest-value next checks are the full service list and the Defender Operational event log.