Microsoft Defender Service Error 2 “Cannot Find the File Specified”

In the aftermath of a malware attack and subsequent removal using specialized programs, you may notice that the Microsoft Defender Antivirus service fails to start on your Windows 10 or 11 computer. One of the common errors users encounter is “Error 2” (0x80070002), which denotes that a file is missing.

defender service error 2

Windows could not start the Microsoft Defender Antivirus Service service on Local Computer.

Error 2: The system cannot find the file specified.

The System Event log records one of the following errors:

Log Name: System
Source: Service Control Manager
Date: 7/8/2022 10:56:31 PM
Event ID: 7000
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Vostro-3470
Description:
The Microsoft Defender Antivirus Service service failed to start due to the following error: 
The system cannot find the file specified.

Log Name: System
Source: Service Control Manager
Date: 7/8/2022 10:52:17 PM
Event ID: 7000
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Vostro-3470
Description:
The WinDefend service failed to start due to the following error: 
The system cannot find the file specified.

Cause

The error occurs because malware may have deleted the following “Platform” folder or some of its subfolders:

C:\ProgramData\Microsoft\Windows Defender\Platform

The Platform folder usually has two sub-folders. One of them has the latest platform update for Microsoft Defender Antivirus, and the other one has the previous platform update that acts as a fallback.

As the Microsoft Defender service registration (“ImagePath” registry value) is pointing to MsMpEng.exe in one of the missing Platform folders, the service control manager encounters “Error 2” when you attempt to start the service.

[Fix] Microsoft Defender Service Error 2 “Cannot Find the File Specified”

To resolve “Error 2” when starting the Defender service, revert to the Inbox CAMP version of the service executable MsMpEng.exe. Follow these steps to do so:

  1. Download windefend-service.zip and save it to the desktop. The zip file contains Windows Defender service registry files for Windows 10 v21H2 and Windows 11 v21H2.
  2. Start regedit.exe under Trusted Installer rights. For more information on how to do that, see the article How to Run Programs as TrustedInstaller
  3. In the Registry Editor window, import the windefend-service.reg file via the File menu.
  4. Exit the Registry Editor and restart Windows.

Note: The registry file above sets the image path for the Windows Defender service to the following executable (a.k.a Inbox CAMP version of MsMpEng.exe):

"%ProgramFiles%\Windows Defender\MsMpEng.exe"

That means you’ll need to install the latest platform update immediately after the Defender service becomes functional.

Note that the following command to revert to the Inbox CAMP version of Defender doesn’t work if the Microsoft Defender service is not running:



"%programfiles%\Windows Defender\MpCmdRun.exe" -resetplatform

Hence the registry editing (registry fix) procedure was suggested above.

warning caution iconWindows Defender service should be functional after a restart. After the Defender service starts, Windows Update will fetch the latest available platform update. Be sure to install the Windows Defender Platform update that shows up on the Windows Update page.

defender platform update

Additional Information

After installing the latest platform update via Microsoft Update, Microsoft Defender accordingly updates its service “ImagePath” registry value. For example, if the newest platform update you downloaded is 4.18.2205.7, the WinDefend service’s ImagePath registry value is automatically set to:

"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2205.7-0\MsMpEng.exe"

defender service error 2 - imagepath registry value

I hope this article helped you fix “Error 2” when starting the Microsoft Defender service.


One small request: If you liked this post, please share this?

One "tiny" share from you would seriously help a lot with the growth of this blog. Some great suggestions:
  • Pin it!
  • Share it to your favorite blog + Facebook, Reddit
  • Tweet it!
So thank you so much for your support. It won't take more than 10 seconds of your time. The share buttons are right below. :)

Ramesh Srinivasan is passionate about Microsoft technologies and he has been a consecutive ten-time recipient of the Microsoft Most Valuable Professional award in the Windows Shell/Desktop Experience category, from 2003 to 2012. He loves to troubleshoot and write about Windows. Ramesh founded Winhelponline.com in 2005.

Leave a Comment