After Win Updates KB5025221 or KB5026361 Problems with Endpoint Antivirus / Policies not working

[Marcos 5,094]

42 minutes ago, klar574 said:

Hello, we are also affected by this error. Are already in contact with the German support. All solutions proposed so far have been unsuccessful. What helps is to disable opening files in real-time protection in ESET settings. This fixes the problems. But that can't be the solution 😉

Please provide the ticket ID so that I can check the logs and what has been suggested and attempted so far.

[klar574 0]

16 hours ago, Marcos said:

Please provide the ticket ID so that I can check the logs and what has been suggested and attempted so far.

CASE_00543002

[Marcos 5,094]

21 minutes ago, klar574 said:

CASE_00543002

Obviously Windows Defender is running:

Microsoft Defender Antivirus-Dienst, c:\programdata\microsoft\windows defender\platform\4.18.23050.5-0\msmpeng.exe, Automatic, Running, , Antimalware Service Executable, Microsoft Corporation

Please make sure that the policy "Turn off Microsoft Defender Antivirus" is set to "Not configured":

Local Group Policy Editor -> Local Computer Policy -> Computer Configuration -> Administrative Templates -> Windows Components -> Microsoft Defender Antivirus -> Turn off Microsoft Defender Antivirus

"If you do not configure this policy setting, Windows will internally manage Microsoft Defender Antivirus. If you install another antivirus program, Windows automatically disables Microsoft Defender Antivirus. Otherwise, Microsoft Defender Antivirus will scan your computers for malware and other potentially unwanted software.

Enabling or disabling this policy may lead to unexpected or unsupported behavior. It is recommended that you leave this policy setting unconfigured."

[klar574 0]

3 hours ago, Marcos said:

Obviously Windows Defender is running:

Microsoft Defender Antivirus-Dienst, c:\programdata\microsoft\windows defender\platform\4.18.23050.5-0\msmpeng.exe, Automatic, Running, , Antimalware Service Executable, Microsoft Corporation

Please make sure that the policy "Turn off Microsoft Defender Antivirus" is set to "Not configured":

Local Group Policy Editor -> Local Computer Policy -> Computer Configuration -> Administrative Templates -> Windows Components -> Microsoft Defender Antivirus -> Turn off Microsoft Defender Antivirus

 

 

"If you do not configure this policy setting, Windows will internally manage Microsoft Defender Antivirus. If you install another antivirus program, Windows automatically disables Microsoft Defender Antivirus. Otherwise, Microsoft Defender Antivirus will scan your computers for malware and other potentially unwanted software.

 

 

Enabling or disabling this policy may lead to unexpected or unsupported behavior. It is recommended that you leave this policy setting unconfigured."

 

 

That was the first suggestion from support to change the entry so that Defender no longer starts. We changed it back, but it doesn't improve anything

[Marcos 5,094]

Do you have "periodic scanning" enabled in Defender then that msmpeng.exe is running?

Microsoft Defender Antivirus-Dienst, c:\programdata\microsoft\windows defender\platform\4.18.23050.5-0\msmpeng.exe, Automatic, Running, , Antimalware Service Executable, Microsoft Corporation

Is ESET registered as a virus & threat protection provider in Windows Security?

[klar574 0]

8 minutes ago, Marcos said:

Do you have "periodic scanning" enabled in Defender then that msmpeng.exe is running?

Microsoft Defender Antivirus-Dienst, c:\programdata\microsoft\windows defender\platform\4.18.23050.5-0\msmpeng.exe, Automatic, Running, , Antimalware Service Executable, Microsoft Corporation

Is ESET registered as a virus & threat protection provider in Windows Security?

[DIMMI 0]

Microsoft didn't fix their bad update?

[Marcos 5,094]

11 hours ago, DIMMI said:

Microsoft didn't fix their bad update?

They made some fix: https://learn.microsoft.com/en-US/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-updates?view=o365-worldwide

• Addressed a deadlock caused by Microsoft Defender Antivirus in rare cases