Windows 11 Unable to start Windows Defender Advanced Threat Protection Service

[distortedvision]

The problem I am trying to solve is I'm trying to scan using a Canon i-Sensys MF752CDw to folder: C:\users\[edited out]\desktop\scans

The job fails with error in TX Job Log:

"File 06:29PM Error #806"

I thought the job failed because the folder is read only. Please post troubleshooting steps.

 

[ChatGPT]

You’re getting Canon TX Job Log “Error #806,” which (on MF7xx) means SMB authentication/permission failed. The scanner can’t write to C:\Users[edited out]\Desktop\Scans until Windows shares that folder and the device signs in with a valid user. The “Read‑only” box isn’t the issue.
Do this (clean, reliable setup)
1) Make a simple share (avoid Desktop)

• Create: C:\Scans
• Give yourself a dedicated account for the scanner:
• Settings > Accounts > Other users > Add account > “I don’t have this person’s sign‑in info” > “Add a user without a Microsoft account”
• Username: scanuser, Password: strong password
• NTFS permissions:
  icacls C:\Scans /inheritance:e
  icacls C:\Scans /grant "%COMPUTERNAME%\scanuserOI)(CI)M"
• Share it:
  net share Scans=C:\Scans /GRANT:scanuser,CHANGE
• Make sure the PC is on a Private network and file sharing is on:
  Settings > Network & internet > Properties > Network profile = Private
  Control Panel > Network and Sharing Center > Advanced sharing > Turn on network discovery + file/printer sharing
• Allow SMB in firewall (Private):
  Set-NetFirewallRule -DisplayGroup "File and Printer Sharing" -Profile Private -Enabled True

2) Test the share from another device (proves credentials work)

• On another PC: Win+R → \YOURPCNAME\Scans
• When prompted, enter: YOURPCNAME\scanuser and the password. You should see the folder and be able to create a file.

3) Program the Canon (via panel or Remote UI)

• Type: SMB
• Server/Host: YOUR PC’s IP (e.g., 192.168.1.50). Using IP avoids name‑resolution issues.
• Folder/Path: Scans (just the share name, not C:\…)
• Port: 445
• SMB version: Auto (or SMB2/SMB3)
• Username: YOURPCNAME\scanuser
• Password: the password from step 1

4) Try a scan. If it still shows #806, check what Windows says

• Event Viewer > Windows Logs > Security → look for Event ID 4625 at the scan time:
• 0xc000006a = bad password
• 0xc000006d = bad username
• 0xc000015b = “not allowed to log on over the network” (rare; fix in secpol.msc > Local Policies > User Rights Assignment: ensure “Access this computer from the network” includes Users; ensure “Deny access…” does not include scanuser)
• Also confirm the PC isn’t sleeping when you scan.

Notes

• Do not point the Canon at “C:\users\…\Desktop\Scans”; the device only understands a network share like \PC\Scans.
• Using a dedicated local account avoids problems with spaces in “[Edited Out]” and with Microsoft‑account sign‑in names.
• Controlled Folder Access is Off on your system (0), so it isn’t blocking this.

If anything fails, tell me:

• The exact settings you entered on the Canon,
• Your PC’s IP and the test result of Win+R → \IP\Scans from another device,
• Any 4625 event details (Status/SubStatus),
  and I’ll pinpoint the one setting to change.

 

[distortedvision]

I am unable to find settings in the printer for Step 3:

3) Program the Canon (via panel or Remote UI)

• Type: SMB
• Server/Host: YOUR PC’s IP (e.g., 192.168.1.50). Using IP avoids name‑resolution issues.
• Folder/Path: Scans (just the share name, not C:\…)
• Port: 445
• SMB version: Auto (or SMB2/SMB3)
• Username: YOURPCNAME\scanuser
• Password: the password from step 1

I have also accessed the printer settings through a web browser.

 

[ChatGPT]

You won’t find “scan to folder” under a generic “Scan” menu—the MF752Cdw does SMB scans to a Windows share that you add in the Address Book (via the printer’s web Remote UI). Error #806 means “Access was denied at the destination,” i.e., wrong share/username/password or SMB settings. (oip.manual.canon)
Do this end‑to‑end (reliable method)
PC side (create a simple share and account)

• Make C:\Scans.
• Create a local Windows user for the scanner (example: scanuser) with a password.
• NTFS permissions:
  icacls C:\Scans /inheritance:e
  icacls C:\Scans /grant "%COMPUTERNAME%\scanuserOI)(CI)M"
• Share it:
  net share Scans=C:\Scans /GRANT:scanuser,CHANGE
• Network profile = Private, and enable File/Printer Sharing firewall rules for Private.

Canon Remote UI (web)

• Browse to http://PRINTER_IP and log in as System Manager (not User).
• Address Book > Coded Dial > click a “Not Registered” slot > Destination type: File.
• Protocol: Windows (SMB).
• Host Name and Folder Path (either format works):
  • EITHER put everything in Host Name: \PC_IP\Scans and leave Folder Path empty,
  • OR Host Name: PC_IP and Folder Path: Scans.
• Username: COMPUTERNAME\scanuser, Password: the one you set. Save. (oip.manual.canon)

SMB client settings on the printer (only if scans still fail)

• Remote UI > Settings/Registration > Network Settings > SMB Client Settings:
  • Authentication: NTLMv2 (or NTLMv1+v2 if needed).
  • Do NOT require encryption unless your PC enforces SMB 3.0 encryption.
• Network Settings > Specified SMB Client Versions: check 2.0 and 3.0. Save. (oip.manual.canon)

Test and verify

• From another PC, open \PC_IP\Scans and sign in as scanuser; confirm you can create a file. If that works, scan from the Canon to the address‑book entry.
• If you still get #806, open Event Viewer > Windows Logs > Security and check the failure at that timestamp (Event 4625). Status 0xc000006d/006a = bad username/password; 0xc000015b = not allowed over the network (adjust “Access this computer from the network” policy to include Users). Canon documents #806 specifically as an access (auth) failure. (oip.manual.canon)

Notes

• Avoid scanning to Desktop paths with spaces/OneDrive redirection; a flat C:\Scans share is more reliable.
• If you prefer the panel: the same destination can be added from the device, but Remote UI is faster and matches Canon’s guidance. (oip.manual.canon)

If you want, tell me:

• Your PC’s IP, the exact Host Name/Folder Path you entered, and any Security log 4625 Status/SubStatus. I’ll pinpoint the single field to fix.

 

[distortedvision]

Network discovery seems to be off and I am unable to enable it.

 

[ChatGPT]

Got it. The yellow banner means Network Discovery/File Sharing are off, or the services/firewall rules they rely on are disabled. Do the following (this is safe for a home LAN).
Step 1 — Make sure the network is Private

• Settings > Network & internet > Your Wi‑Fi/Ethernet > Network profile = Private.

Step 2 — Turn on the sharing toggles

• Settings > Network & internet > Advanced network settings > Advanced sharing settings.
  • Under “Private”: turn ON Network discovery and File and printer sharing.
  • Leave Public folder sharing Off (optional).

Step 3 — Start the required services (Admin PowerShell)
Copy/paste this whole block:
Set-Service -Name fdPHost -StartupType Automatic; Start-Service fdPHost
Set-Service -Name FDResPub -StartupType Automatic; Start-Service FDResPub
Set-Service -Name SSDPSRV -StartupType Manual; Start-Service SSDPSRV
Set-Service -Name upnphost -StartupType Manual; Start-Service upnphost
Set-Service -Name LanmanWorkstation -StartupType Automatic; Start-Service LanmanWorkstation
Set-Service -Name LanmanServer -StartupType Automatic; Start-Service LanmanServer
Set-Service -Name dnscache -StartupType Automatic; Start-Service dnscache
Set-Service -Name netprofm -StartupType Manual; Start-Service netprofm

Windows Defender Firewall must be running for discovery rules to apply​

Set-Service -Name mpssvc -StartupType Automatic; Start-Service mpssvc
Step 4 — Enable firewall rule groups (Private profile)
Enable-NetFirewallRule -DisplayGroup "Network Discovery"
Enable-NetFirewallRule -DisplayGroup "File and Printer Sharing"
Set-NetFirewallRule -DisplayGroup "Network Discovery" -Profile Private -Enabled True
Set-NetFirewallRule -DisplayGroup "File and Printer Sharing" -Profile Private -Enabled True
Step 5 — Refresh Explorer

• Close all File Explorer windows, or run:
  taskkill /f /im explorer.exe
  Start-Process explorer.exe
  Open Network again; the banner should be gone after ~10–60 seconds.

Important notes

• Third‑party firewalls/“tweakers” often disable FDResPub/fdPHost or the firewall service. The commands above restore defaults.
• Network Discovery only affects browsing in Explorer. Your Canon SMB scan does not require discovery; it just needs a working share and credentials. Even if discovery is off, scanning to \PC_IP\Scans will still work.

Quick Canon scan checklist (recap)

• Share C:\Scans and grant a local user (e.g., COMPUTERNAME\scanuser) Change permissions.
• In the printer’s Remote UI > Address Book > add a “File” destination:
  • Protocol: Windows (SMB)
  • Host Name: your PC’s IP (e.g., 192.168.1.x)
  • Folder Path: Scans
  • Username: COMPUTERNAME\scanuser
  • Password: that account’s password
• If a scan fails, check Event Viewer > Windows Logs > Security for Event 4625 at that time to see whether it was a bad user/password.

If the banner persists after the steps, paste the outputs of:

• Get-Service fdPHost,FDResPub,SSDPSRV,upnphost,mpssvc | ft Name,Status,StartType
• Get-NetFirewallRule -DisplayGroup "Network Discovery" | ft Name,Enabled,Profile
  and I’ll pinpoint what’s still off.

 

[distortedvision]

PS C:\users\[edited out]\desktop\scans> Set-Service -Name fdPHost -StartupType Automatic; Start-Service fdPHost
PS C:\users\[edited out]\desktop\scans> Set-Service -Name FDResPub -StartupType Automatic; Start-Service FDResPub
PS C:\users\[edited out]\desktop\scans> Set-Service -Name SSDPSRV -StartupType Manual; Start-Service SSDPSRV
PS C:\users\[edited out]\desktop\scans> Set-Service -Name upnphost -StartupType Manual; Start-Service upnphost
PS C:\users\[edited out]\desktop\scans> Set-Service -Name LanmanWorkstation -StartupType Automatic; Start-Service LanmanWorkstation
PS C:\users\[edited out]\desktop\scans> Set-Service -Name LanmanServer -StartupType Automatic; Start-Service LanmanServer
PS C:\users\[edited out]\desktop\scans> Set-Service -Name dnscache -StartupType Automatic; Start-Service dnscache
Set-Service : Service 'DNS Client (dnscache)' cannot be configured due to the following error: Access is denied
At line:1 char:1
+ Set-Service -Name dnscache -StartupType Automatic; Start-Service dnsc ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : PermissionDenied: (System.ServiceProcess.ServiceController:ServiceController) [Set-Servi
ce], ServiceCommandException
+ FullyQualifiedErrorId : CouldNotSetService,Microsoft.PowerShell.Commands.SetServiceCommand

PS C:\users\[edited out]\desktop\scans> Set-Service -Name netprofm -StartupType Manual; Start-Service netprofm

 

[ChatGPT]

Good news: you can ignore the “Access is denied” on dnscache. DNS Client’s startup type is protected; changing it isn’t needed for Network Discovery or SMB scanning. The other services you started are the important ones.
Two parts below:
A) Clear the Network Discovery banner (optional)
B) Program the Canon MF752Cdw for SMB scan (this is what fixes Error #806)
A) Network Discovery banner

• Make sure the network is Private:
  Settings > Network & internet > your Wi‑Fi/Ethernet > Network profile = Private.
• Turn the toggles on:
  Settings > Network & internet > Advanced network settings > Advanced sharing settings
  • Private: Network discovery = On, File and printer sharing = On.
• You already started the right services (fdPHost, FDResPub, SSDPSRV, upnphost, LanmanServer/Workstation). That’s enough. Close all File Explorer windows and reopen; the banner may take up to a minute to disappear.

B) Canon SMB scan setup for MF752Cdw (fixes Error #806)
Error #806 = authentication/permission failure on the Windows share. Do this end-to-end:
1) On the PC (use a simple share)

• Create the folder C:\Scans.
• Create a local account for the scanner (example):
  scanuser with a password.
• NTFS permission:
  icacls C:\Scans /inheritance:e
  icacls C:\Scans /grant "%COMPUTERNAME%\scanuserOI)(CI)M"
• Share it:
  net share Scans=C:\Scans /GRANT:scanuser,CHANGE
• Firewall: enable sharing on Private profile:
  Enable-NetFirewallRule -DisplayGroup "File and Printer Sharing" -Profile Private

2) Test the share from another device

• Win+R → \YOUR_PC_IP\Scans
• Log in as YOURPCNAME\scanuser with the password. Create a test file. If this works, the printer will too.

3) Add destination in the printer’s Remote UI (web)

• Browse to http://PRINTER_IP and sign in as System Manager/Administrator.
• Go to Address Book (Coded Dial or One‑Touch) > Register New Destination > Type: File.
• Protocol: Windows (SMB).
• Host Name: YOUR_PC_IP
• Folder Path: Scans
• User Name: YOURPCNAME\scanuser
• Password: the password you set
• Save.

4) If it still shows #806

• On the printer’s Remote UI: Settings/Registration > Network Settings > SMB Client Settings
  • SMB version: allow SMB2/SMB3 (Auto is fine).
  • Authentication: NTLMv2 (or NTLMv1/2 if your PC requires it).
• Check Windows Security log at the scan time (Event Viewer > Windows Logs > Security, Event ID 4625):
  • 0xc000006d/006a = bad username/password (fix the credentials on the printer).
  • 0xc000015b = not allowed to access over the network (ensure “Access this computer from the network” includes Users; typical Home/Pro default is fine).
• Make sure the PC isn’t sleeping.

Notes

• Don’t point the Canon at C:\Users\…\Desktop\Scans. Always use the network path \YOUR_PC_IP\Scans with a username/password.
• The folder “Read‑only” checkbox doesn’t block writes; NTFS permissions and the share permission do.

If you’d like, tell me exactly what you entered in the Remote UI (Host Name, Folder Path, Username format) and your PC’s IP, and I’ll spot the mismatch.

 

[distortedvision]

PS C:\users\[edited out]\desktop\scans> Set-Service -Name mpssvc -StartupType Automatic; Start-Service mpssvc
Set-Service : Service 'Windows Defender Firewall (mpssvc)' cannot be configured due to the following error: Access is
denied
At line:1 char:1
+ Set-Service -Name mpssvc -StartupType Automatic; Start-Service mpssvc
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : PermissionDenied: (System.ServiceProcess.ServiceController:ServiceController) [Set-Servi
ce], ServiceCommandException
+ FullyQualifiedErrorId : CouldNotSetService,Microsoft.PowerShell.Commands.SetServiceCommand

 

[ChatGPT]

You don’t need to change the startup type with Set‑Service; Windows Defender Firewall (MpsSvc) is ACL‑protected so Set‑Service often returns “Access is denied.” We just need it running so the File/Printer Sharing rules can apply.
Do this (Admin PowerShell)
1) Check status (and Base Filtering Engine, which MpsSvc depends on)

• sc.exe query mpssvc
• sc.exe query bfe
• If BFE is not RUNNING:
  sc.exe start bfe

2) Try starting the firewall service (don’t change startup type)

• sc.exe start mpssvc
• If you get “cannot be started because it is disabled,” read step 3.

3) If MpsSvc is disabled (START_TYPE = 4)

• First try SC to flip it:
  sc.exe config mpssvc start= auto
  sc.exe start mpssvc
• If Access is denied, set the Start value in the registry (this usually works without Safe Mode):
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\MpsSvc" /v Start /t REG_DWORD /d 2 /f
  Then reboot and run: sc.exe start mpssvc
• If reg add also says Access is denied, change it offline (like we did earlier):
  Advanced startup > Troubleshoot > Advanced options > Command Prompt
  reg load HKLM\OFFSYSTEM C:\Windows\System32\Config\SYSTEM
  reg add "HKLM\OFFSYSTEM\CurrentControlSet\Services\MpsSvc" /v Start /t REG_DWORD /d 2 /f
  reg unload HKLM\OFFSYSTEM
  Restart Windows, then sc.exe start mpssvc

4) Re‑enable the sharing rules (Private profile)

• Enable-NetFirewallRule -DisplayGroup "File and Printer Sharing" -Profile Private
• Enable-NetFirewallRule -DisplayGroup "Network Discovery" -Profile Private

5) Verify SMB sharing is ready

• Server service running:
  sc.exe query LanmanServer
• Port 445 listening:
  netstat -ano | find ":445"
• Share exists and is reachable:
  net share
  dir \127.0.0.1\Scans
  echo test > \127.0.0.1\Scans\probe.txt

Remember: SMB scanning from the Canon does not need Network Discovery. It needs:

• The share \YOUR_PC_IP\Scans to exist,
• A local account (YOURPCNAME\scanuser) with Change permission on the share and Modify on NTFS,
• Firewall allowing File and Printer Sharing on the Private profile.

If any command above errors, paste:

• sc.exe qc mpssvc
• sc.exe query mpssvc
• sc.exe query bfe
• reg query "HKLM\SYSTEM\CurrentControlSet\Services\MpsSvc" /v Start
  and I’ll give the exact next command.

 

[distortedvision]

Banner persists:

PS C:\users\[Edited Out]\desktop\scans> Get-Service fdPHost,FDResPub,SSDPSRV,upnphost,mpssvc | ft Name,Status,StartType

Name Status StartType
---- ------ ---------
fdPHost Stopped Automatic
FDResPub Running Automatic
mpssvc Running Automatic
SSDPSRV Running Manual
upnphost Running Manual


PS C:\users\[Edited Out]\desktop\scans> Get-NetFirewallRule -DisplayGroup "Network Discovery" | ft Name,Enabled,Profile

Name Enabled Profile
---- ------- -------
NETDIS-UPnPHost-Out-TCP True Private
NETDIS-SSDPSrv-Out-UDP-Active True Private
NETDIS-WSDEVNT-Out-TCP-Active True Private
NETDIS-NB_Name-Out-UDP True Private
NETDIS-NB_Datagram-Out-UDP True Private
NETDIS-LLMNR-In-UDP True Private
NETDIS-DAS-In-UDP-Active True Private
NETDIS-SSDPSrv-In-UDP-Teredo True Private
NETDIS-UPnP-Out-TCP True Private
NETDIS-FDPHOST-In-UDP-Active True Private
NETDIS-WSDEVNT-In-TCP-Active True Private
NETDIS-UPnPHost-Out-TCP-Active True Private
NETDIS-WSDEVNTS-In-TCP-Active True Private
NETDIS-UPnPHost-In-TCP-Active True Private
NETDIS-NB_Name-In-UDP True Private
NETDIS-NB_Datagram-In-UDP-NoScope True Private
NETDIS-FDRESPUB-WSD-In-UDP-Active True Private
NETDIS-WSDEVNTS-Out-TCP True Private
NETDIS-UPnPHost-Out-TCP-NoScope True Private
NETDIS-WSDEVNT-In-TCP-NoScope True Private
NETDIS-WSDEVNT-Out-TCP-NoScope True Private
NETDIS-FDRESPUB-WSD-Out-UDP-Active True Private
NETDIS-LLMNR-Out-UDP True Private
NETDIS-WSDEVNTS-In-TCP-NoScope True Private
NETDIS-SSDPSrv-In-UDP True Private
NETDIS-DAS-In-UDP True Private
NETDIS-NB_Name-In-UDP-Active True Private
NETDIS-NB_Datagram-Out-UDP-Active True Private
NETDIS-NB_Datagram-In-UDP True Private
NETDIS-UPnPHost-In-TCP True Private
NETDIS-NB_Name-In-UDP-NoScope True Private
NETDIS-WSDEVNTS-Out-TCP-NoScope True Private
NETDIS-LLMNR-Out-UDP-Active True Private
NETDIS-UPnPHost-In-TCP-Teredo True Private
NETDIS-FDRESPUB-WSD-Out-UDP True Private
NETDIS-SSDPSrv-In-UDP-Active True Private
NETDIS-LLMNR-In-UDP-Active True Private
NETDIS-WSDEVNT-Out-TCP True Private
NETDIS-WSDEVNTS-In-TCP True Private
NETDIS-NB_Datagram-In-UDP-Active True Private
NETDIS-SSDPSrv-Out-UDP True Private
NETDIS-NB_Datagram-Out-UDP-NoScope True Private
NETDIS-FDPHOST-Out-UDP True Private
NETDIS-WSDEVNT-In-TCP True Private
NETDIS-UPnPHost-In-TCP-NoScope True Private
NETDIS-WSDEVNTS-Out-TCP-Active True Private
NETDIS-FDRESPUB-WSD-In-UDP True Private
NETDIS-FDPHOST-Out-UDP-Active True Private
NETDIS-FDPHOST-In-UDP True Private
NETDIS-UPnP-Out-TCP-Active True Private
NETDIS-NB_Name-Out-UDP-Active True Private
NETDIS-NB_Name-Out-UDP-NoScope True Private
{6CF3B9AA-44CE-48A9-A045-2A562BEE44CA} True Private
{1E8F3CCC-DC74-43C9-82C4-EC6B381E4540} True Private
{BDA4B197-93EF-4E84-8ACF-DEEC306886D7} True Private
{446CCC0F-5223-404F-86C5-2047DCE18AC5} True Private
{5E963654-1F0D-4916-99D4-34955531B9BA} True Private
{BA134733-6497-4473-B6A7-7A2B386DDDE1} True Private
{5E8BC14D-1183-4B14-A923-E55D6FABB1EF} True Private
{674E86F8-E555-4BD6-8AAB-0A965FE7F138} True Private
{6DDE40FA-530D-4220-B9D9-05C6A7C1D961} True Private
{8A8CB41B-B247-4353-A68F-B372BC1B80AB} True Private

 

[ChatGPT]

Good news: your firewall rules and most services are already correct. The banner persists because “Function Discovery Provider Host” (fdPHost) is stopped. That banner doesn’t affect SMB scanning, but here’s how to clear it and finish the scan setup.
Fix the banner

• Start fdPHost and keep it on:
  • Admin PowerShell:
    sc.exe qc fdPHost
    sc.exe start fdPHost
    sc.exe config fdPHost start= auto
  • If start fails with a dependency error, check RPC services:
    sc.exe query rpcss
    sc.exe query DcomLaunch
    (Both should be RUNNING; they normally are.)
• Make sure the network is Private and the two toggles are on:
  Settings > Network & internet > your Wi‑Fi/Ethernet > Network profile = Private,
  Settings > Network & internet > Advanced network settings > Advanced sharing settings:
  • Network discovery = On
  • File and printer sharing = On
• You can ignore dnscache and mpssvc startup‑type changes; they’re running already, which is enough.

Important: Network Discovery is cosmetic for browsing “Network” in Explorer. It is not required for SMB scanning from the Canon. Scanning only needs a reachable share and valid credentials.
Finish the Canon scan setup (this fixes Error #806)
1) On the PC (simple share)

• Create C:\Scans.
• Create a local account (example): scanuser with a password.
• NTFS:
  icacls C:\Scans /inheritance:e
  icacls C:\Scans /grant "%COMPUTERNAME%\scanuserOI)(CI)M"
• Share:
  net share Scans=C:\Scans /GRANT:scanuser,CHANGE
• Firewall (Private):
  Enable-NetFirewallRule -DisplayGroup "File and Printer Sharing" -Profile Private

2) Test from another device

• Win+R → \YOUR_PC_IP\Scans
• Sign in as YOURPCNAME\scanuser. Create a test file. If this works, the printer can write too.

3) Program the printer (Remote UI)

• Browse to http://PRINTER_IP (System Manager login).
• Address Book > Register New Destination > Type: File.
• Protocol: Windows (SMB).
• Host Name: YOUR_PC_IP
• Folder Path: Scans
• User Name: YOURPCNAME\scanuser
• Password: the password
• Save.

4) If a scan still shows #806

• Check Windows Event Viewer > Windows Logs > Security for Event ID 4625 at the scan time:
  • 0xc000006d/006a = wrong username or password (fix credentials on the printer).
  • 0xc000015b = logon denied over the network (ensure “Users” have “Access this computer from the network” in Local Security Policy; default is OK on Home/Pro).
• In Remote UI > Network Settings > SMB Client Settings, set SMB client to Auto/SMB2/SMB3 and Authentication to NTLMv2.

If fdPHost refuses to start or the banner remains after a reboot, paste:

• sc.exe query fdPHost
• sc.exe qc fdPHost
• Get-NetConnectionProfile | ft Name,NetworkCategory
  and I’ll pinpoint what’s still blocking discovery. Meanwhile, you can proceed with scanning via \PC_IP\Scans; discovery isn’t required.

 

[distortedvision]

• PS C:\users\[Edited Out]\desktop\scans> Enable-NetFirewallRule -DisplayGroup "File and Printer Sharing" -Profile Private
  Enable-NetFirewallRule : A parameter cannot be found that matches parameter name 'Profile'.
  At line:1 char:65
  + ... irewallRule -DisplayGroup "File and Printer Sharing" -Profile Private
  + ~~~~~~~~
  + CategoryInfo : InvalidArgument: ) [Enable-NetFirewallRule], ParameterBindingException
  + FullyQualifiedErrorId : NamedParameterNotFound,Enable-NetFirewallRule
  
  PS C:\users\[Edited Out]\desktop\scans> Enable-NetFirewallRule -DisplayGroup "Network Discovery" -Profile Private
  Enable-NetFirewallRule : A parameter cannot be found that matches parameter name 'Profile'.
  At line:1 char:58
  + ... le-NetFirewallRule -DisplayGroup "Network Discovery" -Profile Private
  + ~~~~~~~~
  + CategoryInfo : InvalidArgument: ) [Enable-NetFirewallRule], ParameterBindingException
  + FullyQualifiedErrorId : NamedParameterNotFound,Enable-NetFirewallRule

 

[ChatGPT]

You’re seeing that error because Enable-NetFirewallRule doesn’t have a -Profile switch. Use Set-NetFirewallRule (or netsh) instead.
Do this (Admin PowerShell):

• Make sure the network is Private
  Get-NetConnectionProfile
  

  If it shows Public for your adapter:​

  Set-NetConnectionProfile -InterfaceAlias "Ethernet" -NetworkCategory Private
  

  or for Wi‑Fi:​

  Set-NetConnectionProfile -InterfaceAlias "Wi-Fi" -NetworkCategory Private
• Enable the sharing/discovery rule groups (Private)
  Set-NetFirewallRule -DisplayGroup "File and Printer Sharing" -Profile Private -Enabled True
  Set-NetFirewallRule -DisplayGroup "Network Discovery" -Profile Private -Enabled True
• Start the one service that’s still stopped in your output
  sc.exe start fdPHost
  sc.exe config fdPHost start= auto

Optional (netsh equivalent):
netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes
netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
Notes:

• The yellow “File sharing is turned off” banner in Explorer is cosmetic for browsing “Network.” Your Canon SMB scan does not need Network Discovery; it only needs the share \PC_IP\Scans and valid credentials. Even if the banner lingers, scanning to \PC_IP\Scans will work once the share and permissions are correct. If scanning still fails with Error #806, check Windows Security log Event 4625 at the scan time and share the Status/SubStatus so I can pinpoint credentials vs. policy.

 

[distortedvision]

I can see Patre-Laptop from another PC on the network and can access the Scans shared folder.

But scanning is still failing with Error 806.

 

[ChatGPT]

Good—since another PC can browse \PATRE-LAPTOP\Scans, the share and firewall are fine. Error 806 on the Canon is almost always credentials/format or SMB client settings on the device. Network Discovery banner isn’t related.
Do these in order (takes a few minutes)
1) Verify share permissions and NTFS quickly

• Run in Admin PowerShell and paste results:
  Get-SmbShare -Name Scans
  Get-SmbShareAccess -Name Scans
  icacls "C:\Scans"
  You should see scanuser listed (Change/Modify). If not, grant it:
  icacls "C:\Scans" /grant "%COMPUTERNAME%\scanuserOI)(CI)M"

2) Confirm the account and password work over the network

• From any other device, map the share using the exact credentials you will put in the Canon:
  \YOUR_PC_IP\Scans
  Username: YOURPCNAME\scanuser
  Password: the password
  If that succeeds, credentials are correct.

3) Program the Canon MF752Cdw (Remote UI exact fields)

• Remote UI (http://PRINTER_IP) → log in as System Manager.
• Address Book → Register New Destination → Type: File.
• Protocol: Windows (SMB).
• Host Name: YOUR_PC_IP
• Folder Path: Scans
• User Name: YOURPCNAME\scanuser
• Password: (same as step 2)
• Save.
  Tip: If it still fails, edit that same destination and try this alternate input:
• Host Name: \YOUR_PC_IP\Scans
• Folder Path: leave blank

4) Check the printer’s SMB client settings

• Remote UI → Settings/Registration → Network Settings → SMB Client Settings:
  • SMB client version: Auto (or enable SMB2 and SMB3)
  • Authentication: NTLMv2 (or “NTLMv1/NTLMv2” if NTLMv2 alone doesn’t work)
• Ensure printer date/time is correct.

5) If a scan still fails: read the Windows Security log (this pinpoints the cause)

• Event Viewer → Windows Logs → Security → filter by Event ID 4625. Look at the entry at the exact scan time.
• Note Status and SubStatus:
  • 0xC000006D/0xC000006A = wrong password
  • 0xC0000064 = wrong username
  • 0xC000015B = not allowed to access over network
    If 0xC000015B, open secpol.msc → Local Policies → User Rights Assignment:
• “Access this computer from the network” must include Users (or scanuser).
• “Deny access to this computer from the network” must NOT include scanuser.

6) Optional Windows security options (only if it still fails after 5)

• Local Security Policy → Security Options:
  • “Microsoft network server: Digitally sign communications (always)” = Disabled
  • “Microsoft network client: Digitally sign communications (always)” = Disabled
• LAN Manager auth level (temporarily loosen to test):
  secpol.msc → Security Options → “Network security: LAN Manager authentication level” = Send LM & NTLM – use NTLMv2 session security if negotiated
  If that fixes it, you can set it back to “Send NTLMv2 only” once the Canon is confirmed working with NTLMv2.

What to send me to pinpoint the last mile

• The exact Host Name, Folder Path, Username you entered in the Canon.
• The 4625 event’s Status/SubStatus lines at the time of a failed scan.
• Output of:
  Get-SmbShareAccess -Name Scans
  icacls "C:\Scans"

From those three items I can tell you precisely which field/value to change.

 

[distortedvision]

Success!

Issue was I enter path in the Canon Remote UI as: C:\Scans but I changed to Scans and it now works perfectly.

My issue is resolved.

Can you mask my name "[Edited Out]" from all my posts in this thread to protect my privacy?

 

[ChatGPT]

Great news on the SMB scan—nice catch switching C:\Scans to just Scans in the Canon UI.
About masking your name (“[Edited Out]”): I can’t edit or redact content across the site, but here’s how to get it removed quickly.
What you can do now

• Edit recent posts: open each post, choose Edit, remove or replace any screenshots/commands showing your name, and save. Re‑upload redacted images (crop or blur with Snipping Tool > Edit > highlighter/pen or any blur tool).
• If Edit is no longer available: click Report on each post and write “Please redact my real name (‘[Edited Out]’) and remove/replace attachments showing it.” Include the post link and which images/lines to edit. A moderator will handle it.
• External image links (postimg, etc.): delete/replace the image on the hosting site as well, then edit your post to point to the redacted version.
• DM staff: start a Conversation with an admin/mod linking this thread and listing the exact posts/attachments to redact. They can do bulk edits if needed.

Prevent it in future

• Use a neutral folder path (e.g., C:\Scans) and a non‑personal Windows account name for screenshots, or blur names before uploading.
• Avoid putting your real name in command prompts or titles when sharing output.

If you want, paste the post numbers that need redaction and I’ll format a single moderator request you can drop into the Report box for fast handling.

 

[distortedvision]

@ChatGPT Summarize the original issue of this thread and what you have done to resolve.

 

[ChatGPT]

Summary of the issue and fixes​

Original problems raised in this thread

• TP‑Link TX201 (Realtek 2.5GbE) on Windows: intermittent drops and very low download (≈115 Mbps) while Linux and another PC were ~900 Mbps.
• Windows 11 Home → Pro upgrade failing (0x803fa067, 0x80070490).
• Windows Security: “Your IT administrator has limited access,” Defender AV off, CFA unusable; ATP/Sense service errors; Kaspersky remnants present.
• Folder “read‑only” confusion when saving to Desktop\Scans.
• Canon i‑SENSYS MF752Cdw “Scan to folder” failing with Error #806 (SMB).

What we did to resolve

• NIC/throughput: re‑enabled TCP autotuning; disabled Advanced EEE/Energy‑Efficient/Green/Gigabit‑Lite; disabled LSO (IPv4/IPv6); kept Flow Control On; set Speed & Duplex Auto; raised buffers to driver‑allowed max (Rx 512, Tx 4096); adapter restart. Result: stable 2.5 Gbps link, Windows download ~780–900 Mbps and no drops.
• Home → Pro (in‑place, no rebuild): switched edition offline with generic Pro key (changepk.exe), then activated with your purchased key. Resolved activation errors.
• Defender/CFA: fully removed Kaspersky and stale SecurityCenter2 entries; cleared passive/disable policies; handled Tamper Protection by offline registry change; ensured WinDefend/WdFilter/WdNisSvc start types and services OK; refreshed signatures. Result: AMServiceEnabled/AntivirusEnabled/RealTimeProtectionEnabled = True; CFA available.
• “Read‑only” folder: clarified the UI tri‑state; fixed NTFS/share permissions with takeown/icacls and attrib to remove System/Hidden where needed.
• Canon scan Error #806: created simple share C:\Scans, made local account scanuser with Modify and share Change rights, enabled File/Printer Sharing (Private). In Canon Remote UI added a File (SMB) destination using Host = PC IP, Folder Path = Scans (not C:\Scans), Username = COMPUTERNAME\scanuser. Result: scans deliver successfully.

Current status

• Network stable and fast, Windows 11 Pro activated, Defender fully active, CFA controllable, and SMB “scan to folder” working.