Windows 11 Unable to start Windows Defender Advanced Threat Protection Service

• The script line had a typo (missing value name on the Real‑Time Protection key).
• “Access is denied” is almost always Defender Tamper Protection and/or not running the shell elevated. Tamper Protection blocks changing Defender’s services and registry values.

• Windows Security > Virus & threat protection > Manage settings > Tamper Protection = Off.
• If the app won’t open or shows stale info: run this, then try again and turn it Off:
  Get-AppxPackage Microsoft.SecHealthUI -AllUsers | Reset-AppxPackage

• Right‑click Start > Windows Terminal (Admin) or PowerShell (Admin).

• Admin PowerShell:
  Get-MpComputerStatus | Select AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled,PassiveMode
  Set-MpPreference -EnableControlledFolderAccess Enabled
• Turn Tamper Protection back On in Windows Security.

• sc.exe qc WinDefend
• sc.exe query WinDefend
• Get-MpComputerStatus | Select AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled,PassiveMode
  and I’ll give the next exact fix.

• Repair/refresh Defender signatures:
  
  Code:

  $mp = "$env:ProgramFiles\Windows Defender\MpCmdRun.exe"
  & $mp -RemoveDefinitions -All
  & $mp -SignatureUpdate

  (Alternative)
  
  Code:

  Start-Process -FilePath "$env:ProgramFiles\Windows Defender\MpCmdRun.exe" -ArgumentList "-RemoveDefinitions -All" -Wait
  Start-Process -FilePath "$env:ProgramFiles\Windows Defender\MpCmdRun.exe" -ArgumentList "-SignatureUpdate" -Wait

Get-MpComputerStatus | Select AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled,PassiveMode
# If any are False or PassiveMode is True, run:
Start-Service WinDefend, WdNisSvc, SecurityHealthService

Set-MpPreference -EnableControlledFolderAccess Enabled

• Tamper Protection is Off while you run the commands, then turn it back On after.
• Services are running: sc.exe query WinDefend should show STATE = RUNNING. If not, post:
  
  Code:

  sc.exe query WinDefend
  Get-MpComputerStatus | Select AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled,PassiveMode

  and I’ll give the next exact fix.

• Turn Tamper Protection OFF temporarily:
  Windows Security > Virus & threat protection > Manage settings > Tamper Protection = Off.

• Check the feature:
  dism /online /Get-Features /Format:Table | findstr /i Defender
• If you see Windows-Defender-Features = Disabled, enable it:
  dism /online /Enable-Feature /FeatureName:Windows-Defender-Features /All /NoRestart
• Repair system files (safe):
  sfc /scannow
  DISM /online /Cleanup-Image /RestoreHealth

• sc.exe qc WinDefend
• sc.exe queryex WinDefend
• sc.exe qc WdNisSvc
• sc.exe queryex WdNisSvc
• wevtutil qe System /q:"*[System[Provider[@Name='Service Control Manager'] and (EventID=7000 or EventID=7001 or EventID=7034)]" /c:5 /f:text /rd:true

• If “The system cannot find the file specified”: the Defender platform folder is missing; the PlatformUpdate above should fix it. If not, run Windows Update or do an in‑place repair (keep apps/files) from the 24H2 ISO.
• If “Access is denied”: Tamper Protection is still on, or a policy remains—recheck step 1 and confirm Tamper is Off while changing services.
• If WDFilter driver isn’t running (sc query wdfilter shows Stopped/Not found): run sfc/DISM again; this driver is part of Defender features.

• Turn OFF Tamper Protection temporarily: Windows Security > Virus & threat protection > Manage settings > Tamper Protection = Off.
• Open Windows Terminal or PowerShell as Administrator.

Refresh Defender engine/signatures​

• sc.exe qc WinDefend
• sc.exe query WinDefend
• sc.exe query WdFilter
• Get-MpComputerStatus | Select AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled,PassiveMode

• If WdFilter was Disabled (Start=4) earlier, changing it to 0 (Boot start) requires that reboot in Step 1 before WinDefend can run.
• If you ever see “Access is denied” again while changing Defender settings, Tamper Protection is still on. Turn it off temporarily, make the changes, then re‑enable it.

• Settings > System > Recovery > Advanced startup > Restart now.
• Troubleshoot > Advanced options > Startup Settings > Restart > press 4 (Safe Mode).

• Turn off Tamper Protection and clear “passive/disable” flags
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
  reg delete "HKLM\SOFTWARE\Microsoft\Windows Defender" /v PassiveMode /f
  reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirus /f
  reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f
  reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection" /v ForceDefenderPassiveMode /f
• Ensure Defender drivers/services start
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v Start /t REG_DWORD /d 0 /f
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v Start /t REG_DWORD /d 2 /f
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v Start /t REG_DWORD /d 3 /f
• Reboot normally.

• Start services
  sc.exe start WinDefend
  sc.exe start WdNisSvc
  sc.exe start SecurityHealthService
• Refresh Defender engine/signatures
  $mp="$envrogramFiles\Windows Defender\MpCmdRun.exe"
  & $mp -RemoveDefinitions -All
  & $mp -SignatureUpdate
• Verify Defender is active
  Get-MpComputerStatus | Select AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled,PassiveMode
  sc.exe query WinDefend

• Turn CFA on:
  Set-MpPreference -EnableControlledFolderAccess Enabled
• Open Windows Security > Virus & threat protection > Manage settings and turn Tamper Protection back On.
  If the app still shows “limited access”, reset it:
  Get-AppxPackage Microsoft.SecHealthUI -AllUsers | Reset-AppxPackage
  Reboot once.

• sc query WinDefend
• Get-MpComputerStatus | Select AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled,PassiveMode
• reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection
  and I’ll give the next exact command.

• Settings > System > Recovery > Advanced startup > Restart now.
• Troubleshoot > Advanced options > Command Prompt.
• Choose your account and sign in.

• Find your Windows drive (in WinRE it might not be C. One of these will show files:
  dir C:\Windows
  dir D:\Windows
  Assume it’s on C: in the example below. If yours is D:, replace C: with D:.
• Load the SOFTWARE and SYSTEM hives:
  reg load HKLM\OFFSOFT C:\Windows\System32\Config\SOFTWARE
  reg load HKLM\OFFSYSTEM C:\Windows\System32\Config\SYSTEM
• Turn off Tamper Protection and clear passive/disable policies (offline):
  reg add "HKLM\OFFSOFT\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
  reg delete "HKLM\OFFSOFT\Microsoft\Windows Defender" /v PassiveMode /f
  reg delete "HKLM\OFFSOFT\Policies\Microsoft\Windows Defender" /v DisableAntiVirus /f
  reg delete "HKLM\OFFSOFT\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f
  reg delete "HKLM\OFFSOFT\Policies\Microsoft\Windows Advanced Threat Protection" /v ForceDefenderPassiveMode /f
• Ensure Defender drivers/services start at boot/auto:
  reg add "HKLM\OFFSYSTEM\CurrentControlSet\Services\WdFilter" /v Start /t REG_DWORD /d 0 /f
  reg add "HKLM\OFFSYSTEM\CurrentControlSet\Services\WinDefend" /v Start /t REG_DWORD /d 2 /f
  reg add "HKLM\OFFSYSTEM\CurrentControlSet\Services\WdNisSvc" /v Start /t REG_DWORD /d 3 /f
• Unload the hives:
  reg unload HKLM\OFFSOFT
  reg unload HKLM\OFFSYSTEM
• Type exit and Continue to Windows.

• Start services and refresh Defender:
  sc.exe start WinDefend
  sc.exe start WdNisSvc
  sc.exe start SecurityHealthService
  $mp = "$envrogramFiles\Windows Defender\MpCmdRun.exe"
  & $mp -RemoveDefinitions -All
  & $mp -SignatureUpdate
• Verify Defender is active:
  Get-MpComputerStatus | Select AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled,PassiveMode
• Enable Controlled Folder Access:
  Set-MpPreference -EnableControlledFolderAccess Enabled
• If the Windows Security app still shows “limited access,” reset it:
  Get-AppxPackage Microsoft.SecHealthUI -AllUsers | Reset-AppxPackage
  Reboot once, then re‑check.

• The drive you used in WinRE (C: or D,
• Output of sc query WinDefend,
• Output of Get-MpComputerStatus | Select AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled,PassiveMode,
  and I’ll provide the next exact fix.

• Run (Admin PowerShell):
  Set-MpPreference -EnableControlledFolderAccess Enabled
  Get-MpPreference | Select EnableControlledFolderAccess
  

  1 = Enabled, 0 = Disabled​

• Optional allow-lists:
  Add-MpPreference -ControlledFolderAccessAllowedApplications "C:\Path\YourApp.exe"
  Add-MpPreference -ControlledFolderAccessProtectedFolders "D:\Data"

• Windows Security > Virus & threat protection > Manage settings > Tamper Protection = On.
• If the UI still shows “limited access,” reset it, then reopen:
  Get-AppxPackage Microsoft.SecHealthUI -AllUsers | Reset-AppxPackage

• Signatures up to date:
  $mp="$envrogramFiles\Windows Defender\MpCmdRun.exe"; & $mp -SignatureUpdate
• Services running and status OK:
  sc.exe query WinDefend
  Get-MpComputerStatus | Select AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled,IsTamperProtected
• Note: PassiveMode should be False/blank now. If it ever shows True:
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v PassiveMode /t REG_DWORD /d 0 /f
  Restart-Computer

• Enable and verify (Admin PowerShell):
  Set-MpPreference -EnableControlledFolderAccess Enabled
  Get-MpPreference | Select EnableControlledFolderAccess # 1 means enabled
• Optional allow‑lists:
  Add-MpPreference -ControlledFolderAccessAllowedApplications "C:\Path\YourApp.exe"
  Add-MpPreference -ControlledFolderAccessProtectedFolders "D:\Data"
• You can also turn it on in the UI: Windows Security > Virus & threat protection > Ransomware protection.

• Replace the path with your exact folder name (note the capital S in Scans):
  takeown /F "C:\Users[edited out]\Desktop\Scans" /R /D Y
  icacls "C:\Users[edited out]\Desktop\Scans" /inheritance:e
  icacls "C:\Users[edited out]\Desktop\Scans" /grant "%USERNAME%OI)(CI)M" /T

• CFA protects Desktop by default and will block untrusted apps from writing there.
  PowerShell (admin):
  (Get-MpPreference).EnableControlledFolderAccess
  • 1 = On. Either allow your app:
  Add-MpPreference -ControlledFolderAccessAllowedApplications "C:\Path\To\YourApp.exe"
  (Re‑run your app and save to Scans.)
  • Or temporarily test with CFA off:
  Set-MpPreference -EnableControlledFolderAccess Disabled
  Test saving, then re‑enable when done:
  Set-MpPreference -EnableControlledFolderAccess Enabled

• The folder Read‑only box will still show a filled square after all this; that’s normal and not a problem.
• If OneDrive is backing up Desktop (Known Folder Move), it can set System on some items; removing S/H from your Scans folder is safe, but don’t do it on the Desktop root.

• The exact app and error you see when writing to …\Scans,
• Output of: icacls "C:\Users[edited out]\Desktop\Scans"
  and I’ll tailor the next command(s).

• The Read-only box on a folder is a tri‑state and doesn’t control write access. It often reappears filled even when you can write. Writes are controlled by NTFS permissions (and CFA, which you’ve confirmed is Off: 0).
• Your icacls line failed because of the stray “/” at the end. Use /T to apply to children.

• Replace nothing—path already correct; just run:
  icacls "C:\Users[edited out]\Desktop\Scans" /inheritance:e
  icacls "C:\Users[edited out]\Desktop\Scans" /grant "%USERNAME%OI)(CI)M" /T

• CMD:
  echo test > "C:\Users[edited out]\Desktop\Scans\test.txt"
• PowerShell:
  New-Item -Path "C:\Users[edited out]\Desktop\Scans\test.txt" -ItemType File -Force | Out-Null

• icacls "C:\Users[edited out]\Desktop\Scans"
• The exact error you see when creating test.txt
• Whether this Desktop is under OneDrive (does %UserProfile%\OneDrive\Desktop exist and contain Scans?)