Microsoft Defender Service Error 2 “Cannot Find the File Specified”

In the aftermath of a malware attack and subsequent removal using specialized programs, you may notice that the Microsoft Defender Antivirus service fails to start on your Windows 10 or 11 computer. One of the common errors users encounter is “Error 2” (0x80070002), which denotes that a file is missing.

Windows could not start the Microsoft Defender Antivirus Service service on Local Computer.

Error 2: The system cannot find the file specified.

The System Event log records one of the following errors:

Log Name: System
Source: Service Control Manager
Date: 7/8/2022 10:56:31 PM
Event ID: 7000
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Vostro-3470
Description:
The Microsoft Defender Antivirus Service service failed to start due to the following error: 
The system cannot find the file specified.

Log Name: System
Source: Service Control Manager
Date: 7/8/2022 10:52:17 PM
Event ID: 7000
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Vostro-3470
Description:
The WinDefend service failed to start due to the following error: 
The system cannot find the file specified.

Cause

The error occurs because malware may have deleted the following “Platform” folder or some of its subfolders:

C:\ProgramData\Microsoft\Windows Defender\Platform

The Platform folder usually has two sub-folders. One of them has the latest platform update for Microsoft Defender Antivirus, and the other one has the previous platform update that acts as a fallback.

As the Microsoft Defender service registration (“ImagePath” registry value) is pointing to MsMpEng.exe in one of the missing Platform folders, the service control manager encounters “Error 2” when you attempt to start the service.

[Fix] Microsoft Defender Service Error 2 “Cannot Find the File Specified”

To resolve “Error 2” when starting the Defender service, revert to the Inbox CAMP version of the service executable MsMpEng.exe. Follow these steps to do so:

1. Download windefend-service.zip and save it to the desktop. The zip file contains Windows Defender service registry files for Windows 10 v21H2 and Windows 11 v21H2.
2. Start regedit.exe under Trusted Installer rights. For more information on how to do that, see the article How to Run Programs as TrustedInstaller
3. In the Registry Editor window, import the windefend-service.reg file via the File menu.
4. Exit the Registry Editor and restart Windows.

Note: The registry file above sets the image path for the Windows Defender service to the following executable (a.k.a Inbox CAMP version of MsMpEng.exe):

"%ProgramFiles%\Windows Defender\MsMpEng.exe"

That means you’ll need to install the latest platform update immediately after the Defender service becomes functional.

"%programfiles%\Windows Defender\MpCmdRun.exe" -resetplatform

Windows Defender service should be functional after a restart. After the Defender service starts, Windows Update will fetch the latest available platform update. Be sure to install the Windows Defender Platform update that shows up on the Windows Update page.

Additional Information

After installing the latest platform update via Microsoft Update, Microsoft Defender accordingly updates its service “ImagePath” registry value. For example, if the newest platform update you downloaded is 4.18.2205.7, the WinDefend service’s ImagePath registry value is automatically set to:

"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2205.7-0\MsMpEng.exe"

I hope this article helped you fix “Error 2” when starting the Microsoft Defender service.