Windows 11 Unable to start Windows Defender Advanced Threat Protection Service

• Create: C:\Scans
• Give yourself a dedicated account for the scanner:
• Settings > Accounts > Other users > Add account > “I don’t have this person’s sign‑in info” > “Add a user without a Microsoft account”
• Username: scanuser, Password: strong password
• NTFS permissions:
  icacls C:\Scans /inheritance:e
  icacls C:\Scans /grant "%COMPUTERNAME%\scanuserOI)(CI)M"
• Share it:
  net share Scans=C:\Scans /GRANT:scanuser,CHANGE
• Make sure the PC is on a Private network and file sharing is on:
  Settings > Network & internet > Properties > Network profile = Private
  Control Panel > Network and Sharing Center > Advanced sharing > Turn on network discovery + file/printer sharing
• Allow SMB in firewall (Private):
  Set-NetFirewallRule -DisplayGroup "File and Printer Sharing" -Profile Private -Enabled True

• On another PC: Win+R → \YOURPCNAME\Scans
• When prompted, enter: YOURPCNAME\scanuser and the password. You should see the folder and be able to create a file.

• Type: SMB
• Server/Host: YOUR PC’s IP (e.g., 192.168.1.50). Using IP avoids name‑resolution issues.
• Folder/Path: Scans (just the share name, not C:\…)
• Port: 445
• SMB version: Auto (or SMB2/SMB3)
• Username: YOURPCNAME\scanuser
• Password: the password from step 1

• Event Viewer > Windows Logs > Security → look for Event ID 4625 at the scan time:
• 0xc000006a = bad password
• 0xc000006d = bad username
• 0xc000015b = “not allowed to log on over the network” (rare; fix in secpol.msc > Local Policies > User Rights Assignment: ensure “Access this computer from the network” includes Users; ensure “Deny access…” does not include scanuser)
• Also confirm the PC isn’t sleeping when you scan.

• Do not point the Canon at “C:\users\…\Desktop\Scans”; the device only understands a network share like \PC\Scans.
• Using a dedicated local account avoids problems with spaces in “[Edited Out]” and with Microsoft‑account sign‑in names.
• Controlled Folder Access is Off on your system (0), so it isn’t blocking this.

• The exact settings you entered on the Canon,
• Your PC’s IP and the test result of Win+R → \IP\Scans from another device,
• Any 4625 event details (Status/SubStatus),
  and I’ll pinpoint the one setting to change.

• Type: SMB
• Server/Host: YOUR PC’s IP (e.g., 192.168.1.50). Using IP avoids name‑resolution issues.
• Folder/Path: Scans (just the share name, not C:\…)
• Port: 445
• SMB version: Auto (or SMB2/SMB3)
• Username: YOURPCNAME\scanuser
• Password: the password from step 1

• Make C:\Scans.
• Create a local Windows user for the scanner (example: scanuser) with a password.
• NTFS permissions:
  icacls C:\Scans /inheritance:e
  icacls C:\Scans /grant "%COMPUTERNAME%\scanuserOI)(CI)M"
• Share it:
  net share Scans=C:\Scans /GRANT:scanuser,CHANGE
• Network profile = Private, and enable File/Printer Sharing firewall rules for Private.

• Browse to http://PRINTER_IP and log in as System Manager (not User).
• Address Book > Coded Dial > click a “Not Registered” slot > Destination type: File.
• Protocol: Windows (SMB).
• Host Name and Folder Path (either format works):
  • EITHER put everything in Host Name: \PC_IP\Scans and leave Folder Path empty,
  • OR Host Name: PC_IP and Folder Path: Scans.
• Username: COMPUTERNAME\scanuser, Password: the one you set. Save.

• Remote UI > Settings/Registration > Network Settings > SMB Client Settings:
  • Authentication: NTLMv2 (or NTLMv1+v2 if needed).
  • Do NOT require encryption unless your PC enforces SMB 3.0 encryption.
• Network Settings > Specified SMB Client Versions: check 2.0 and 3.0. Save.

• From another PC, open \PC_IP\Scans and sign in as scanuser; confirm you can create a file. If that works, scan from the Canon to the address‑book entry.
• If you still get #806, open Event Viewer > Windows Logs > Security and check the failure at that timestamp (Event 4625). Status 0xc000006d/006a = bad username/password; 0xc000015b = not allowed over the network (adjust “Access this computer from the network” policy to include Users). Canon documents #806 specifically as an access (auth) failure.

• Avoid scanning to Desktop paths with spaces/OneDrive redirection; a flat C:\Scans share is more reliable.
• If you prefer the panel: the same destination can be added from the device, but Remote UI is faster and matches Canon’s guidance.

• Your PC’s IP, the exact Host Name/Folder Path you entered, and any Security log 4625 Status/SubStatus. I’ll pinpoint the single field to fix.

• Settings > Network & internet > Your Wi‑Fi/Ethernet > Network profile = Private.

• Settings > Network & internet > Advanced network settings > Advanced sharing settings.
  • Under “Private”: turn ON Network discovery and File and printer sharing.
  • Leave Public folder sharing Off (optional).

Windows Defender Firewall must be running for discovery rules to apply​

• Close all File Explorer windows, or run:
  taskkill /f /im explorer.exe
  Start-Process explorer.exe
  Open Network again; the banner should be gone after ~10–60 seconds.

• Third‑party firewalls/“tweakers” often disable FDResPub/fdPHost or the firewall service. The commands above restore defaults.
• Network Discovery only affects browsing in Explorer. Your Canon SMB scan does not require discovery; it just needs a working share and credentials. Even if discovery is off, scanning to \PC_IP\Scans will still work.

• Share C:\Scans and grant a local user (e.g., COMPUTERNAME\scanuser) Change permissions.
• In the printer’s Remote UI > Address Book > add a “File” destination:
  • Protocol: Windows (SMB)
  • Host Name: your PC’s IP (e.g., 192.168.1.x)
  • Folder Path: Scans
  • Username: COMPUTERNAME\scanuser
  • Password: that account’s password
• If a scan fails, check Event Viewer > Windows Logs > Security for Event 4625 at that time to see whether it was a bad user/password.

• Get-Service fdPHost,FDResPub,SSDPSRV,upnphost,mpssvc | ft Name,Status,StartType
• Get-NetFirewallRule -DisplayGroup "Network Discovery" | ft Name,Enabled,Profile
  and I’ll pinpoint what’s still off.

• Make sure the network is Private:
  Settings > Network & internet > your Wi‑Fi/Ethernet > Network profile = Private.
• Turn the toggles on:
  Settings > Network & internet > Advanced network settings > Advanced sharing settings
  • Private: Network discovery = On, File and printer sharing = On.
• You already started the right services (fdPHost, FDResPub, SSDPSRV, upnphost, LanmanServer/Workstation). That’s enough. Close all File Explorer windows and reopen; the banner may take up to a minute to disappear.

• Create the folder C:\Scans.
• Create a local account for the scanner (example):
  scanuser with a password.
• NTFS permission:
  icacls C:\Scans /inheritance:e
  icacls C:\Scans /grant "%COMPUTERNAME%\scanuserOI)(CI)M"
• Share it:
  net share Scans=C:\Scans /GRANT:scanuser,CHANGE
• Firewall: enable sharing on Private profile:
  Enable-NetFirewallRule -DisplayGroup "File and Printer Sharing" -Profile Private

• Win+R → \YOUR_PC_IP\Scans
• Log in as YOURPCNAME\scanuser with the password. Create a test file. If this works, the printer will too.

• Browse to http://PRINTER_IP and sign in as System Manager/Administrator.
• Go to Address Book (Coded Dial or One‑Touch) > Register New Destination > Type: File.
• Protocol: Windows (SMB).
• Host Name: YOUR_PC_IP
• Folder Path: Scans
• User Name: YOURPCNAME\scanuser
• Password: the password you set
• Save.

• On the printer’s Remote UI: Settings/Registration > Network Settings > SMB Client Settings
  • SMB version: allow SMB2/SMB3 (Auto is fine).
  • Authentication: NTLMv2 (or NTLMv1/2 if your PC requires it).
• Check Windows Security log at the scan time (Event Viewer > Windows Logs > Security, Event ID 4625):
  • 0xc000006d/006a = bad username/password (fix the credentials on the printer).
  • 0xc000015b = not allowed to access over the network (ensure “Access this computer from the network” includes Users; typical Home/Pro default is fine).
• Make sure the PC isn’t sleeping.

• Don’t point the Canon at C:\Users\…\Desktop\Scans. Always use the network path \YOUR_PC_IP\Scans with a username/password.
• The folder “Read‑only” checkbox doesn’t block writes; NTFS permissions and the share permission do.

• sc.exe query mpssvc
• sc.exe query bfe
• If BFE is not RUNNING:
  sc.exe start bfe

• sc.exe start mpssvc
• If you get “cannot be started because it is disabled,” read step 3.

• First try SC to flip it:
  sc.exe config mpssvc start= auto
  sc.exe start mpssvc
• If Access is denied, set the Start value in the registry (this usually works without Safe Mode):
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\MpsSvc" /v Start /t REG_DWORD /d 2 /f
  Then reboot and run: sc.exe start mpssvc
• If reg add also says Access is denied, change it offline (like we did earlier):
  Advanced startup > Troubleshoot > Advanced options > Command Prompt
  reg load HKLM\OFFSYSTEM C:\Windows\System32\Config\SYSTEM
  reg add "HKLM\OFFSYSTEM\CurrentControlSet\Services\MpsSvc" /v Start /t REG_DWORD /d 2 /f
  reg unload HKLM\OFFSYSTEM
  Restart Windows, then sc.exe start mpssvc

• Enable-NetFirewallRule -DisplayGroup "File and Printer Sharing" -Profile Private
• Enable-NetFirewallRule -DisplayGroup "Network Discovery" -Profile Private

• Server service running:
  sc.exe query LanmanServer
• Port 445 listening:
  netstat -ano | find ":445"
• Share exists and is reachable:
  net share
  dir \127.0.0.1\Scans
  echo test > \127.0.0.1\Scans\probe.txt

• The share \YOUR_PC_IP\Scans to exist,
• A local account (YOURPCNAME\scanuser) with Change permission on the share and Modify on NTFS,
• Firewall allowing File and Printer Sharing on the Private profile.

• sc.exe qc mpssvc
• sc.exe query mpssvc
• sc.exe query bfe
• reg query "HKLM\SYSTEM\CurrentControlSet\Services\MpsSvc" /v Start
  and I’ll give the exact next command.

• Start fdPHost and keep it on:
  • Admin PowerShell:
    sc.exe qc fdPHost
    sc.exe start fdPHost
    sc.exe config fdPHost start= auto
  • If start fails with a dependency error, check RPC services:
    sc.exe query rpcss
    sc.exe query DcomLaunch
    (Both should be RUNNING; they normally are.
• Make sure the network is Private and the two toggles are on:
  Settings > Network & internet > your Wi‑Fi/Ethernet > Network profile = Private,
  Settings > Network & internet > Advanced network settings > Advanced sharing settings:
  • Network discovery = On
  • File and printer sharing = On
• You can ignore dnscache and mpssvc startup‑type changes; they’re running already, which is enough.

• Create C:\Scans.
• Create a local account (example): scanuser with a password.
• NTFS:
  icacls C:\Scans /inheritance:e
  icacls C:\Scans /grant "%COMPUTERNAME%\scanuserOI)(CI)M"
• Share:
  net share Scans=C:\Scans /GRANT:scanuser,CHANGE
• Firewall (Private):
  Enable-NetFirewallRule -DisplayGroup "File and Printer Sharing" -Profile Private

• Win+R → \YOUR_PC_IP\Scans
• Sign in as YOURPCNAME\scanuser. Create a test file. If this works, the printer can write too.

• Browse to http://PRINTER_IP (System Manager login).
• Address Book > Register New Destination > Type: File.
• Protocol: Windows (SMB).
• Host Name: YOUR_PC_IP
• Folder Path: Scans
• User Name: YOURPCNAME\scanuser
• Password: the password
• Save.

• Check Windows Event Viewer > Windows Logs > Security for Event ID 4625 at the scan time:
  • 0xc000006d/006a = wrong username or password (fix credentials on the printer).
  • 0xc000015b = logon denied over the network (ensure “Users” have “Access this computer from the network” in Local Security Policy; default is OK on Home/Pro).
• In Remote UI > Network Settings > SMB Client Settings, set SMB client to Auto/SMB2/SMB3 and Authentication to NTLMv2.

• sc.exe query fdPHost
• sc.exe qc fdPHost
• Get-NetConnectionProfile | ft Name,NetworkCategory
  and I’ll pinpoint what’s still blocking discovery. Meanwhile, you can proceed with scanning via \PC_IP\Scans; discovery isn’t required.

• PS C:\users\[Edited Out]\desktop\scans> Enable-NetFirewallRule -DisplayGroup "File and Printer Sharing" -Profile Private
  Enable-NetFirewallRule : A parameter cannot be found that matches parameter name 'Profile'.
  At line:1 char:65
  + ... irewallRule -DisplayGroup "File and Printer Sharing" -Profile Private
  + ~~~~~~~~
  + CategoryInfo : InvalidArgument: ) [Enable-NetFirewallRule], ParameterBindingException
  + FullyQualifiedErrorId : NamedParameterNotFound,Enable-NetFirewallRule
  
  PS C:\users\[Edited Out]\desktop\scans> Enable-NetFirewallRule -DisplayGroup "Network Discovery" -Profile Private
  Enable-NetFirewallRule : A parameter cannot be found that matches parameter name 'Profile'.
  At line:1 char:58
  + ... le-NetFirewallRule -DisplayGroup "Network Discovery" -Profile Private
  + ~~~~~~~~
  + CategoryInfo : InvalidArgument: ) [Enable-NetFirewallRule], ParameterBindingException
  + FullyQualifiedErrorId : NamedParameterNotFound,Enable-NetFirewallRule

• Make sure the network is Private
  Get-NetConnectionProfile
  

  If it shows Public for your adapter:​

  Set-NetConnectionProfile -InterfaceAlias "Ethernet" -NetworkCategory Private
  

  or for Wi‑Fi:​

  Set-NetConnectionProfile -InterfaceAlias "Wi-Fi" -NetworkCategory Private
• Enable the sharing/discovery rule groups (Private)
  Set-NetFirewallRule -DisplayGroup "File and Printer Sharing" -Profile Private -Enabled True
  Set-NetFirewallRule -DisplayGroup "Network Discovery" -Profile Private -Enabled True
• Start the one service that’s still stopped in your output
  sc.exe start fdPHost
  sc.exe config fdPHost start= auto

• The yellow “File sharing is turned off” banner in Explorer is cosmetic for browsing “Network.” Your Canon SMB scan does not need Network Discovery; it only needs the share \PC_IP\Scans and valid credentials. Even if the banner lingers, scanning to \PC_IP\Scans will work once the share and permissions are correct. If scanning still fails with Error #806, check Windows Security log Event 4625 at the scan time and share the Status/SubStatus so I can pinpoint credentials vs. policy.

• Run in Admin PowerShell and paste results:
  Get-SmbShare -Name Scans
  Get-SmbShareAccess -Name Scans
  icacls "C:\Scans"
  You should see scanuser listed (Change/Modify). If not, grant it:
  icacls "C:\Scans" /grant "%COMPUTERNAME%\scanuserOI)(CI)M"

• From any other device, map the share using the exact credentials you will put in the Canon:
  \YOUR_PC_IP\Scans
  Username: YOURPCNAME\scanuser
  Password: the password
  If that succeeds, credentials are correct.

• Remote UI (http://PRINTER_IP) → log in as System Manager.
• Address Book → Register New Destination → Type: File.
• Protocol: Windows (SMB).
• Host Name: YOUR_PC_IP
• Folder Path: Scans
• User Name: YOURPCNAME\scanuser
• Password: (same as step 2)
• Save.
  Tip: If it still fails, edit that same destination and try this alternate input:
• Host Name: \YOUR_PC_IP\Scans
• Folder Path: leave blank

• Remote UI → Settings/Registration → Network Settings → SMB Client Settings:
  • SMB client version: Auto (or enable SMB2 and SMB3)
  • Authentication: NTLMv2 (or “NTLMv1/NTLMv2” if NTLMv2 alone doesn’t work)
• Ensure printer date/time is correct.

• Event Viewer → Windows Logs → Security → filter by Event ID 4625. Look at the entry at the exact scan time.
• Note Status and SubStatus:
  • 0xC000006D/0xC000006A = wrong password
  • 0xC0000064 = wrong username
  • 0xC000015B = not allowed to access over network
    If 0xC000015B, open secpol.msc → Local Policies → User Rights Assignment:
• “Access this computer from the network” must include Users (or scanuser).
• “Deny access to this computer from the network” must NOT include scanuser.

• Local Security Policy → Security Options:
  • “Microsoft network server: Digitally sign communications (always)” = Disabled
  • “Microsoft network client: Digitally sign communications (always)” = Disabled
• LAN Manager auth level (temporarily loosen to test):
  secpol.msc → Security Options → “Network security: LAN Manager authentication level” = Send LM & NTLM – use NTLMv2 session security if negotiated
  If that fixes it, you can set it back to “Send NTLMv2 only” once the Canon is confirmed working with NTLMv2.

• The exact Host Name, Folder Path, Username you entered in the Canon.
• The 4625 event’s Status/SubStatus lines at the time of a failed scan.
• Output of:
  Get-SmbShareAccess -Name Scans
  icacls "C:\Scans"

• Edit recent posts: open each post, choose Edit, remove or replace any screenshots/commands showing your name, and save. Re‑upload redacted images (crop or blur with Snipping Tool > Edit > highlighter/pen or any blur tool).
• If Edit is no longer available: click Report on each post and write “Please redact my real name (‘[Edited Out]’) and remove/replace attachments showing it.” Include the post link and which images/lines to edit. A moderator will handle it.
• External image links (postimg, etc.: delete/replace the image on the hosting site as well, then edit your post to point to the redacted version.
• DM staff: start a Conversation with an admin/mod linking this thread and listing the exact posts/attachments to redact. They can do bulk edits if needed.

• Use a neutral folder path (e.g., C:\Scans) and a non‑personal Windows account name for screenshots, or blur names before uploading.
• Avoid putting your real name in command prompts or titles when sharing output.

Summary of the issue and fixes​

• TP‑Link TX201 (Realtek 2.5GbE) on Windows: intermittent drops and very low download (≈115 Mbps) while Linux and another PC were ~900 Mbps.
• Windows 11 Home → Pro upgrade failing (0x803fa067, 0x80070490).
• Windows Security: “Your IT administrator has limited access,” Defender AV off, CFA unusable; ATP/Sense service errors; Kaspersky remnants present.
• Folder “read‑only” confusion when saving to Desktop\Scans.
• Canon i‑SENSYS MF752Cdw “Scan to folder” failing with Error #806 (SMB).

• NIC/throughput: re‑enabled TCP autotuning; disabled Advanced EEE/Energy‑Efficient/Green/Gigabit‑Lite; disabled LSO (IPv4/IPv6); kept Flow Control On; set Speed & Duplex Auto; raised buffers to driver‑allowed max (Rx 512, Tx 4096); adapter restart. Result: stable 2.5 Gbps link, Windows download ~780–900 Mbps and no drops.
• Home → Pro (in‑place, no rebuild): switched edition offline with generic Pro key (changepk.exe), then activated with your purchased key. Resolved activation errors.
• Defender/CFA: fully removed Kaspersky and stale SecurityCenter2 entries; cleared passive/disable policies; handled Tamper Protection by offline registry change; ensured WinDefend/WdFilter/WdNisSvc start types and services OK; refreshed signatures. Result: AMServiceEnabled/AntivirusEnabled/RealTimeProtectionEnabled = True; CFA available.
• “Read‑only” folder: clarified the UI tri‑state; fixed NTFS/share permissions with takeown/icacls and attrib to remove System/Hidden where needed.
• Canon scan Error #806: created simple share C:\Scans, made local account scanuser with Modify and share Change rights, enabled File/Printer Sharing (Private). In Canon Remote UI added a File (SMB) destination using Host = PC IP, Folder Path = Scans (not C:\Scans), Username = COMPUTERNAME\scanuser. Result: scans deliver successfully.

• Network stable and fast, Windows 11 Pro activated, Defender fully active, CFA controllable, and SMB “scan to folder” working.