Server 2016 not able to install Windows Defender

[Flemming Bruhn]

I have two 2016 domain controllers that had Windows Defender uninstalled a long time ago. Up to now I have been using a third party AV product, but now I want to start using Windows Defender.

But when I run "dism /online /enable-feature:Windows-Defender /all" it fails after 30 pct.

I have read this thread: Install Windows Defender on Server 2016 and this might be the case, but when I look in the CBS.log I can't find a patern pointing to a specific faulty KB registration.

I would be grateful if someone could have a look at the attached CBS.log that only contains one of the powershell sessions. I hope there could be a fix for this.

Thank you, Flemming

 

[Maxstar]

Hi and welcome to Sysnative,

Open an elevated command prompt and run the following command. Attach Dirlist.txt to your next post.

dir /s /a %systemroot%\WinSxS\amd64_windows-defender-drivers_31bf3856ad364e35_10.0.14393.0_none_1e417abb0bebd499 > "%userprofile%\Desktop\Dirlist.txt"

 

[Flemming Bruhn]

Hi and thank you for having a look into my problem.

The dir command returns a 'File Not Found' response in the command prompt.

I did a search in the \WinSxS folder from File explorer and it seems there are no diretories with that name, only a file in the Manifests folder. The screenshot shows the only result I get.

 

[Maxstar]

Hi,

Let's replace this folder first.

Step 1. Download

SFCFix and save it to your desktop.

Warning: This fix was written specifically for this system. Do not run this fix on another system.

• Save any work you have open, and close all programs.
• Download the attachment SFCFix.zip and save it to your desktop.
• Drag the SFCFix.zip file over the SFCFix.exe executable and release it.

• SFCFix will launch, let it complete.
• Once done, a file will appear on your desktop, called SFCFix.txt.
• Post the logfile (SFCFix.txt) as attachment in your next reply.

Step 2. Run the following DISM command and post the result. If it fails attach a new copy of the CBS log.

DISM /online /cleanup-image /RestoreHealth

 

[Flemming Bruhn]

Dism ran to 100% but ended with error: 0x800f081f

From File explorer I can see that I now have a defender-drivers-folder :-

 

[Maxstar]

Here's the next fix.

Step 1.
Warning: This fix was written specifically for this system. Do not run this fix on another system.

• Save any work you have open, and close all programs.
• Download the attachment SFCFix.zip and save it to your desktop.
• Drag the SFCFix.zip file over the SFCFix.exe executable and release it.

• SFCFix will launch, let it complete.
• Once done, a file will appear on your desktop, called SFCFix.txt.
• Post the logfile (SFCFix.txt) as attachment in your next reply.

Step 2. Run the following DISM command and post the result. If it fails attach a new copy of the CBS log.

DISM /online /cleanup-image /RestoreHealth

 

[Flemming Bruhn]

Now the dism cleanup-image was successfull

 

[Maxstar]

Great, please try to install the Windows Defender feature and let me know the result. If it fails attach a new copy of the CBS logs.

 

[Flemming Bruhn]

Unfortunately it did not work ..

 

[Maxstar]

Could you please check if the highlighted folder still exists?

2023-07-04 14:29:38, Warning               CBS    Current tick count lower than last tick count. [HRESULT = 0x8007000d - ERROR_INVALID_DATA]
2023-07-04 14:34:12, Info                  CBS    Failed to find payload files, component:amd64_windows-defender-drivers_31bf3856ad364e35_10.0.14393.0_none_1e417abb0bebd499, file: WdFilter.sys [HRESULT = 0x800f081f - CBS_E_SOURCE_MISSING]
2023-07-04 14:34:12, Info                  CBS    Failed on OnDownloadComplete [HRESULT = 0x800f081f - CBS_E_SOURCE_MISSING]

Attach also a copy of the COMPONENTS hive.

Upload your COMPONENTS hive.

• Navigate to C:\Windows\System32\Config and locate the COMPONENTS file.
• Please copy this file to your desktop.
• Note: If you receive an error that this file is in-use, simply reboot your computer and try again.
• Right-click on this file on your desktop and select Send To > Compressed (zipped) folder. This will create a file named COMPONENTS.ZIP on your desktop.
• If the file is too large to upload here, upload the file to www.wetransfer.com and post the link in your next reply.

 

[Flemming Bruhn]

The folder and the WdFilter.sys file exist

WeTransfer link: https://we.tl/t-RDck5p5N8b

 

[Maxstar]

Here's the next fix to repair the associated registry keys as well.

Warning: This fix was written specifically for this system. Do not run this fix on another system.

• Save any work you have open, and close all programs.
• Download the attachment SFCFixScript.txt and save it to your desktop.
• Drag the SFCFixScript.txt file over the SFCFix.exe executable and release it.

• SFCFix will launch, let it complete.
• Once done, a file will appear on your desktop, called SFCFix.txt.
• Post the logfile (SFCFix.txt) as attachment in your next reply.

Afterwards try to install the Defender feature again. And attach a new copy of the CBS logs when it fails.

 

[Flemming Bruhn]

Just noticed you wrote 'when it fails', and you were right ..

 

[Maxstar]

2023-07-04 15:13:44, Warning               CBS    Current tick count lower than last tick count. [HRESULT = 0x8007000d - ERROR_INVALID_DATA]
2023-07-04 15:17:10, Info                  CBS    Failed to find payload files, component:amd64_windows-defender-service-datalayer_31bf3856ad364e35_10.0.14393.0_none_3029648d0739f25f, file: DataLayer.dll [HRESULT = 0x800f081f - CBS_E_SOURCE_MISSING]
2023-07-04 15:17:10, Info                  CBS    Failed on OnDownloadComplete [HRESULT = 0x800f081f - CBS_E_SOURCE_MISSING]

Here's the next fix for another corrupted component.

Warning: This fix was written specifically for this system. Do not run this fix on another system.

• Save any work you have open, and close all programs.
• Download the attachment SFCFixScript.txt and save it to your desktop.
• Drag the SFCFixScript.txt file over the SFCFix.exe executable and release it.

• SFCFix will launch, let it complete.
• Once done, a file will appear on your desktop, called SFCFix.txt.
• Post the logfile (SFCFix.txt) as attachment in your next reply.

Afterwards try to install the Defender feature again.

 

[Flemming Bruhn]

Here you are ...

 

[Maxstar]

I've just compared several other keys of your components hive with my VM, and multiple keys are corrupted. So I'll need to create a script to re-create them including the associated files.

It seems only the en-US language pack is installed on this server, can you please confirm that?

 

[Flemming Bruhn]

Sorry, how do I check?

 

[Maxstar]

You can run the following command, copy and paste the result in your next post.

DISM /online /get-intl

 

[Flemming Bruhn]

Yes it seems that only en-US are installed

 

[Maxstar]

Let's check the WinSxS folder first:

1. Download Dirlist.zip.
2. Extract this file and run Dirlist.bat as administrator.
3. Attach Dirlist.txt to your next post.