Windows 11 Unable to start Windows Defender Advanced Threat Protection Service

Distorted Vision

Well-Known Member
Joined
Jun 18, 2022
Messages
86
Window could not start the Windows Defender Advanced Threat Protection service on Local Computer

Error 1067. The process terminated unexpectedly.
 
Solution

Quick take​

“Windows Defender Advanced Threat Protection Service” (service name: Sense) is the enterprise EDR sensor for Microsoft Defender for Endpoint. On a PC that is not onboarded to a Defender for Endpoint tenant, starting Sense manually typically returns Error 1067 (process terminated) and then stops. That’s expected and not a problem for consumer/stand‑alone use—the normal antivirus is the “Microsoft Defender Antivirus” service (WinDefend), not Sense.

What do you actually want to do?​

  • If you are NOT onboarding this PC to Microsoft Defender for Endpoint (business/E5), leave Sense alone. Set it to Manual (Trigger Start) and don’t try to start it—your AV protection is still active via WinDefend.
  • If you DO intend...
Sort by date Sort by votes
distortedvision said:
@ChatGPT Summarize the original issue of this thread and what you have done to resolve.
Click to expand...
@ChatGPT Actually just in this thread, not other threads created by the same person or others. This thread is 380533.
 
Upvote 0 Downvote
Here’s a thread‑only recap for 380533 (Unable to start Windows Defender Advanced Threat Protection Service).
Original issue(s)
  • “Windows could not start the Windows Defender Advanced Threat Protection service (Sense). Error 1067.”
  • Windows Security banner: “Your IT administrator has limited access,” and Controlled Folder Access (CFA) could not be opened/changed.
What I diagnosed
  • Sense (Windows Defender Advanced Threat Protection) is the Microsoft Defender for Endpoint EDR sensor. On non‑onboarded/home systems, starting Sense typically fails with 1067 by design; it does not affect antivirus protection.
  • The “limited access” banner and CFA failure were because a third‑party AV (Kaspersky) was still registered with Windows, forcing Microsoft Defender Antivirus into passive/disabled mode. In that state, CFA can’t be managed.
What I did (and provided step‑by‑step)
  • Clarified Sense’s role and gave two paths:
    • If not using Microsoft Defender for Endpoint: leave Sense set to Manual; don’t start it.
    • If you are using it: provided onboarding steps (check OnboardingState, run the official onboarding script, verify SENSE/Operational log).
  • Restoring Defender AV and CFA:
    • Checked SecurityCenter2 to see which AVs were registered; your output showed both Windows Defender and Kaspersky.
    • Supplied commands to remove “disable/passive” Defender policies, start required services (WinDefend, WdNisSvc, SecurityHealthService), and repair/update Defender (SFC/DISM + MpCmdRun).
    • Gave Group Policy/Registry methods to unlock the CFA UI and a PowerShell path (Set‑MpPreference) once Defender is active.
    • In response to error 0x800106ba on Set‑MpPreference, explained it means Defender isn’t active and reiterated the need to remove the third‑party AV first.
    • Advised fully uninstalling Kaspersky (and running its cleanup tool), rebooting, verifying only Defender is registered, then enabling CFA and adding allowed apps/folders as needed.
Current/next step for this thread
  • Remove Kaspersky completely, reboot, confirm only Microsoft Defender is registered, then enable CFA (Set‑MpPreference -EnableControlledFolderAccess Enabled). Sense can remain stopped unless you’re onboarding to Defender for Endpoint.
 
Upvote 0 Downvote

Error 801 on the MF752Cdw = “cannot connect to the file server”​

That means the printer can’t reach or open the share. It’s almost always one of: wrong host/path format, PC asleep, firewall/SMB blocked, or DNS/name lookup. Fix it in this order.
1) On PATRE-Desktop (the target PC)
  • Create a simple share (don’t use Desktop paths):
    • Folder: C:\ScansD
    • Local user for the scanner (example): scanuser_d with a password.
    • NTFS and Share permissions:
      icacls C:\ScansD /inheritance:e
      icacls C:\ScansD /grant "%COMPUTERNAME%\scanuser_dOI)(CI)M"
      net share ScansD=C:\ScansD /GRANT:scanuser_d,CHANGE
  • Network profile and firewall (Private profile):
    • Settings > Network & internet > your adapter > Network profile = Private.
    • Enable file sharing rules:
      netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes
  • Services/port check:
    • sc query LanmanServer (STATE should be RUNNING)
    • netstat -ano | find ":445" (should show LISTENING)
  • Keep the PC awake while testing (no sleep).
2) Test the share from another device
  • Win+R → \PATRE-DESKTOP\ScansD and also \<PATRE-Desktop-IP>\ScansD
  • When prompted, use: PATRE-DESKTOP\scanuser_d + the password.
  • Create a test file. If this works, credentials and share are good.
3) Program the Canon (Remote UI)
  • Remote UI (http://PRINTER_IP) > Address Book > Register New Destination > Type: File.
  • Protocol: Windows (SMB).
  • Use the PC’s IP, not the name:
    • Host Name: <PATRE-Desktop-IP>
    • Folder Path: ScansD (not C:\ScansD)
    • User Name: PATRE-DESKTOP\scanuser_d
    • Password: (as set above)
  • Network settings on printer: Settings/Registration > Network Settings > SMB Client Settings:
    • SMB version: Auto (ensure SMB2/SMB3 are enabled)
    • Authentication: NTLMv2
4) If 801 persists
  • If the scan fails immediately, it’s still a connectivity/name issue. Verify you can ping the PC’s IP from another device, and that the PC isn’t sleeping. Stick with the IP (not the hostname) in the Canon entry.
  • Check Windows Security log at the scan time:
    • If there is NO Event ID 4625, the printer never reached the PC (firewall/route/name). Re‑check step 1 and use the IP.
    • If you do see 4625, the error becomes an auth failure (that’s Error 806); in that case fix username/password or share rights.
If you want, post:
  • The exact Host Name, Folder Path, and User Name you entered for PATRE‑Desktop,
  • The PC’s IP, and
  • The output of: Get-SmbShare -Name ScansD; Get-SmbShareAccess -Name ScansD; icacls C:\ScansD
    and I’ll spot the one field to change.
 
Upvote 0 Downvote
If I pause protection in Kaspersky Internet Security it works successfully.

What settings do I need to change in Kaspersky Internet Security?
 
Upvote 0 Downvote

Why it works when Kaspersky is paused​

Your Canon scans via SMB (TCP 445) to the PC. Kaspersky Internet Security (KIS) is blocking the inbound SMB connection on the PC that hosts the share. You need to allow SMB from the printer, or mark your LAN/printer as trusted.
Do this on the PC that has the shared folder
Option A — Easiest: mark LAN/printer as Trusted
  • Kaspersky > Settings (gear) > Protection > Firewall.
  • Networks (or Manage networks):
    • Set your home network to Trusted.
  • Settings > Network settings > Trusted addresses:
    • Add the printer’s IP (e.g., 192.168.1.50). Save.
  • Test the scan.
Option B — Explicit firewall rule for SMB from the printer
  • Kaspersky > Settings > Protection > Firewall > Configure rules (Packet rules).
  • Add rule:
    • Action: Allow
    • Direction: Incoming
    • Protocol: TCP
    • Local ports: 445 (add 139 as well if you like)
    • Remote address: printer’s IP only (e.g., 192.168.1.50)
    • Network: Local/Trusted
  • Move this rule above any generic “Block incoming” rules. Apply and test.
Option C — Keep KIS AV, use Windows Firewall for LAN
  • In Kaspersky > Protection, turn off only Firewall (leave AV on).
  • In Windows Firewall, ensure “File and Printer Sharing” rules are enabled for Private.
  • Test. If this works, you can stay with Windows Firewall for LAN traffic.
If it still fails
  • In Kaspersky > Reports, filter by Firewall; you’ll see the exact block event (port, IP, app). Click “Create rule” or re‑create the allow rule using the shown details.
  • Also check Intrusion Prevention/Application Control:
    • Application rules > System group > “Windows Operating System” → make sure network activity isn’t blocked for Trusted networks.
Quick checklist
  • Use the printer’s IP in the Canon address book.
  • Share path is Scans (not C:\Scans) and user is PCNAME\scanuser.
  • PC is awake; network profile is Private.
If you tell me your Kaspersky build (e.g., 21.3.x) and share a screenshot of the Firewall screen, I’ll give the exact clicks for that UI.
 
Upvote 0 Downvote
Happy to hear that — glad it’s working!
A few quick follow‑ups you might find helpful (optional):
  • If you created local scan accounts (scanuser), consider changing the password to something strong and store it securely.
  • When not scanning, you can disable the share (net share Scans /delete) or tighten share permissions.
  • Keep Kaspersky rules scoped to the printer IP (allow only that address → port 445) rather than opening SMB to the whole LAN.
  • Save the working Canon Remote UI settings (Host = PC IP, Folder = Scans, Username = PCNAME\scanuser) so you can restore them if needed.
If you want, I can:
  • Draft a moderator request to redact your real name from the thread, or
  • Provide the exact Kaspersky firewall rule steps for your version, or
  • Walk through securing/removing the temporary scan account.
Anything else I can do before you close this out?
 
Upvote 0 Downvote
You must log in or register to reply here.

Similar threads

Windows Defender Advanced Threat Protection Preview Expands
Replies
0
Views
709
News
VIDEO Announcing Windows Defender Advanced Threat Protection
Replies
0
Views
1K
News