In the aftermath of a malware attack and subsequent removal using specialized programs, you may notice that the Microsoft Defender Antivirus service fails to start on your Windows 10 or 11 computer. One of the common errors users encounter is “Error 2” (
0x80070002), which denotes that a file is missing.
Windows could not start the Microsoft Defender Antivirus Service service on Local Computer. Error 2: The system cannot find the file specified.
The System Event log records one of the following errors:
Log Name: System Source: Service Control Manager Date: 7/8/2022 10:56:31 PM Event ID: 7000 Task Category: None Level: Error Keywords: Classic User: N/A Computer: Vostro-3470 Description: The Microsoft Defender Antivirus Service service failed to start due to the following error: The system cannot find the file specified.
Log Name: System Source: Service Control Manager Date: 7/8/2022 10:52:17 PM Event ID: 7000 Task Category: None Level: Error Keywords: Classic User: N/A Computer: Vostro-3470 Description: The WinDefend service failed to start due to the following error: The system cannot find the file specified.
The error occurs because malware may have deleted the following “Platform” folder or some of its subfolders:
The Platform folder usually has two sub-folders. One of them has the latest platform update for Microsoft Defender Antivirus, and the other one has the previous platform update that acts as a fallback.
As the Microsoft Defender service registration (“ImagePath” registry value) is pointing to
MsMpEng.exe in one of the missing Platform folders, the service control manager encounters “Error 2” when you attempt to start the service.
[Fix] Microsoft Defender Service Error 2 “Cannot Find the File Specified”
To resolve “Error 2” when starting the Defender service, revert to the Inbox CAMP version of the service executable MsMpEng.exe. Follow these steps to do so:
- Download windefend-service.zip and save it to the desktop. The zip file contains Windows Defender service registry files for Windows 10 v21H2 and Windows 11 v21H2.
regedit.exeunder Trusted Installer rights. For more information on how to do that, see the article How to Run Programs as TrustedInstaller
- In the Registry Editor window, import the
windefend-service.regfile via the File menu.
- Exit the Registry Editor and restart Windows.
Note: The registry file above sets the image path for the Windows Defender service to the following executable (a.k.a Inbox CAMP version of
That means you’ll need to install the latest platform update immediately after the Defender service becomes functional.
Note that the following command to revert to the Inbox CAMP version of Defender doesn’t work if the Microsoft Defender service is not running:
"%programfiles%\Windows Defender\MpCmdRun.exe" -resetplatform
Hence the registry editing (registry fix) procedure was suggested above.
Windows Defender service should be functional after a restart. After the Defender service starts, Windows Update will fetch the latest available platform update. Be sure to install the Windows Defender Platform update that shows up on the Windows Update page.
After installing the latest platform update via Microsoft Update, Microsoft Defender accordingly updates its service “ImagePath” registry value. For example, if the newest platform update you downloaded is
4.18.2205.7, the WinDefend service’s
ImagePath registry value is automatically set to:
I hope this article helped you fix “Error 2” when starting the Microsoft Defender service.
One small request: If you liked this post, please share this?One "tiny" share from you would seriously help a lot with the growth of this blog. Some great suggestions:
- Pin it!
- Share it to your favorite blog + Facebook, Reddit
- Tweet it!