Windows Defender Antivirus Network Inspection Service issues since Windows 10 2004 update

I got the 2004 update yesterday and that went well enough otherwise but I am having a problem with the Windows Defender Antivirus Network Inspection Service that I did not have previously. 

1. I noticed in Event Viewer several Errors that began immediately upon completion of the update last night: 

The Microsoft Defender Antivirus Network Inspection Service service depends on the Microsoft Defender Antivirus Network Inspection System Driver service which failed to start because of the following error: 

The supplied user buffer is not valid for the requested operation.

2. Further inspection has revealed that there is now a problem with Real Time Updates. 

Microsoft Defender Antivirus Real-Time Protection feature has encountered an error and failed.
  Feature: Network Inspection System
Error Code: 0x8007042c
Error description: The dependency service or group failed to start. 
Reason: The system is missing updates that are required for running Network Inspection System.  Install the required updates and restart the device.

I've got this error repeatedly (3002). 

3. I went into security and maintenance to see what was going on with my security settings. That is not showing anything "wrong." 

4. The Network Inspection Service is configured to manual, not automatic. I can't change this. 

5. Real-time protection is on, and has been on. On Virus & threat protection settings, all of those are still toggled on, and those settings are the same before and after the upgrade. I haven't tried turning them on and off again yet. 

6. I already did the August Safety scan, but I downloaded a fresh copy and am re-running it. 

7. I did dism and sfc checks and they showed no problems that needed repair. 

Something is definitely wrong with the install of Windows Defender tho... Help? How do I fix this and stop the errors and get it reconfigured properly. Do I have to reinstall it? 

* Please try a lower page number.

* Please enter only numbers.

* Please try a lower page number.

* Please enter only numbers.

I went through the configuration for Real Time Protection and toggled them all on and off again. I then looked in the Event Viewer to see those 'events' reflected. 

1. I turned it off... ok

Microsoft Defender Antivirus Real-time Protection scanning for malware and other potentially unwanted software was disabled.

2. I turned it on... 

Microsoft Defender Antivirus Real-time Protection scanning for malware and other potentially unwanted software was enabled.

but it failed to start and I got an error 3002

Microsoft Defender Antivirus Real-Time Protection feature has encountered an error and failed.

  Feature: Network Inspection System

  Error Code: 0x8007042c

  Error description: The dependency service or group failed to start. 

  Reason: The system is missing updates that are required for running Network Inspection System.  Install the required updates and restart the device.

But like I said, I did the dism and sfc and there were no problems found -- do I need to reinstall defender? 

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

I think I found what is missing. After more research and poking around I noticed that WdNisDrv is a required component for WdNisSvc and it is not in the folder 

C:\Program Files\Windows Defenderor 

C:\Program Files\Windows Defender Advanced Threat Protection

As per a Microsoft website: 

The Microsoft Defender Antivirus Network Inspection Service service depends on the Microsoft Defender Antivirus Network Inspection System Driver service which failed to start because of the following error: 

The supplied user buffer is not valid for the requested operation.

The ATP folder was updated during the 2004 upgrade. Repeated running of dism and sfc are not showing anything wrong with this folder. However, Windows Defender folder was not upgraded entirely yesterday.

Some items inside were updated yesterday, but some items were updated on previously. Either those components were not updated in the 2004 update OR there was a read-write permissions error. 

I read through the dism log and there was NO mention of missing files or errors that needed to be corrected (the only errors that were fixed were a few stray AMD files). Plus I verified the permissions on the parent folder and the items inside, and they are all fine for Trusted Installer. 

So something is wrong with Defender or ATP updates? 

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hi,
My name is Mohammed Shuaib, an Independent Advisor & I'm here to assist you with the issue of Windows defender. As per the Error Code: 0x8007042c the service is dependent on WIndows firewall so I suggest you Turn on Windows Firewall. Please follow the below article to Turn on Windows Firewall.

https://windowsreport.com/firewall-error-0x8007...


Let me know the status after performing the above.


Regards
Shuaib
Independent Advisor

Standard Disclaimer: There are links to non-Microsoft websites. The pages appear to be providing accurate, safe information. Watch out for ads on the sites that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the sites before you decide to download and install it.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hi, thanks for the reply.

This issue is not related to Windows Firewall. Firewall is running. This is a problem with WdNisSvc and WdNisDrv. 

Right now I see in services 

mpssvc / Windows Defender Firewall / Running 

The problem is with the Microsoft Defender Antivirus Network Inspection Service service depends on the Microsoft Defender Antivirus Network Inspection System Driver. 

The error code is not just for the firewall but other connectivity issues. I am seeing the error code with the Inspection service because it cannot connect. The later error in the Event Viewer is telling me that missing components are a problem. After further research the best I can tell (I might be wrong) is that the Driver is missing. Visual inspection in the Program Files for Microsoft Defender and ATP show no Driver -- so maybe it is indeed a problem. 

If there is a configuration issue with the firewall that is something I have no idea how to troubleshoot. 

I just completed a full current Safety scan and found no issues. 

As for some of the other instructions on the page you linked, I verified all those other services are indeed running though  FwcAgent is no longer needed with this version of Windows as per what I found on the internet. 


Thanks. 

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hi,
In that case, can you try the suggestions in the below Microsoft link & see if any of those fix the issue for you.

https://answers.microsoft.com/en-us/protect/for...


Regards
Shuaib
Independent Advisor

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Thanks for the reply. 

I've gone through the article linked, and checked all the registry entries.

All the start types were validated and correct.

I am still getting errors in Event Viewer. Something is wrong somewhere and I am more suspicious of the 2004 udpate.


I've located the WdNisDrv  Microsoft Defender Antivirus Network Inspection System Driver as a result of the registry entry and it showing me where to find the file -- but this service isn't listed in services. Should it be? 

I went through the dependencies on the services  tab for WdNisSvc and checked all of them. WdNisDrv is just not listed in the services.msc pane unless it's under a name I can't locate. 


Here is more detailed information about the errors.

Still seeing 
 
The Microsoft Defender Antivirus Network Inspection Service service depends on the Microsoft Defender Antivirus Network Inspection System Driver service which failed to start because of the following error: 

The supplied user buffer is not valid for the requested operation.



What is "user buffer not valid" ?? How do I address this. 

Is this the missing WdNisDrv / driver? 



Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Going to try to simplify the status of this issue: 

Everything seems to be working alright except real time inspection.

Microsoft Defender Antivirus Real-Time Protection feature has encountered an error and failed.

  Feature: Network Inspection System

  Error Code: 0x8007042c

  Error description: The dependency service or group failed to start. 

  Reason: The system is missing updates that are required for running Network Inspection System.  Install the required updates and restart the device.

* The files for the Network Inspection Service driver appear to be where they belong. 

* dism and scf have been run repeatedly and nothing is missing, not having issues with windows update -- that is grabbing antivirus definitions ok too. 

* Network Inspection Service Driver is not showing in services if it should be.

It is showing as a dependency; the icon is different so maybe it isn't a service. All the other services that show as dependencies are there and are running fine (Base Filtering Engine, Remote Procedure Call (RPC), DCOM server Process Launcher, RPC Endpoint Manager) . 

* When I try to manually start the service via services.msc I get error 1068 / The dependency service or group failed to start. 

* The path info for WdNisDrv.sys is 

system32\drivers\wd\WdNisDrv.sys

in regedit. 

The file is physically in the location 

C:\Windows\System32\drivers\wd

Wondering how to approach this if it is a configuration issue.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

I am seeing this same behavior; also on 2004.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hi,
There is an issue with the update as I one more user having the same issue after the update so to resolve this I suggest you follow the below or wait for the next release of updates to see if it fixes the issue.

Reference :
https://www.reddit.com/r/Windows10/comments/hz2...

Fix #1
Step 1:
On the login screen click on Power icon on the right corner

Step 2:
Press Shift Key and press hold and then click Restart (This will restart the system in recovery mode)

Step 3:
In the recovery bluescreen options you’ll need to click (or tap) the Troubleshoot option

Step 4:
Then click on Refresh your PC (Selecting this option keeps data and Windows default programs safe but the programs which you have downloaded and installed or from CD/DVD needs to be re-installed)


Let me know if anything else I can assist you with.

Regards
Shuaib
Independent Advisor

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

So, ignoring the "reset windows" suggestion because...yeah, not doing that...I tried an in-place upgrade and upon initial boot the behavior was gone. However, upon reboot it returned. I gave up for yesterday and went to sleep.

I woke up this morning and decided to try turning off Core Isolation/Virtualization Based Security. That fixed it; Microsoft Defender Antivirus Network Inspection Service now starts and runs without complaint. Apparently Microsoft messed up an update to Defender or something else and caused this to start happening; it's not like this is the first time they have deployed a broken Defender update.

Do you have Core Isolation/VBS enabled, khynnea?

---

Edit: Verified repeatable resolution on a second machine; my Windows 10 Home 2004 laptop.

3 people were helped by this reply

·

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

* Please try a lower page number.

* Please enter only numbers.

* Please try a lower page number.

* Please enter only numbers.

 
 

Question Info


Last updated September 21, 2020 Views 2,856 Applies to: