Windows defender not enabled after uninstalling Kaspersky

[emre7273]

Anyone could help me please,

I need to uninstall Kaspersky Endpoint Security 11 from a Windows 10 client computer, and enable the default Windows Defender on it. However, after I uninstall KES (also reinstalled and tried with kavremover) Windows Defender is still grayed out and real-time protection can’t be enabled. Every information I have read tells me to remove the installed antivirus to automatically enable Windows Defender, however it is not the case. 

I have set HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware to 0

Disabled the local policy  Turn Off Microsoft Defender Antivirus from gpedit.msc

Rebooted the computer many times

But still Windows Security Center shows no antivirus providers available and Security at a glance page is completely empty.

I think Kaspersky installation is disabling somethings and not fixing them again when uninstalling, leaving the Windows Defender unable to be enabled again. Please help me get rid of this problem, really appreciated!

 

[DonKid]

Please, open a ticket here.

[emre7273]

I found out myself,

Installation of KES removes some windows services related to Defender. And uninstalling KES does not restore those services...

From a tenforums.com page named “restore default services windows 10” I have downloaded the registry files to create these services which were missing;

Windows_Security_Service

Windows_Defender_Firewall

Windows_Defender_Advanced_Threat_Protection_Service

Microsoft_Defender_Antivirus_Service

Microsoft_Defender_Antivirus_Network_Inspection_Service

For the HKLM\SYSTEM\CurrentControlSet\Services\WinDefend key I had to change the ImagePath for the existing version; "C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2201.10-0\MsMpEng.exe"

Then I rebooted the computer, services came back.

Ran “DISM.exe /Online /Cleanup-image /Restorehealth” and after that “SFC /scannow” and rebooted again.

Then I ran windows update, and rebooted again.

And there was Defender working again.