Windows Security Service Started and then Stopped in Windows 11

After installing the Windows 11 22H2 update, the Windows Security dialog may not launch. It may show a blank page, as shown below:

Also, when you attempt to start the Windows Security Service (“SecurityHealthService“) using the Services MMC console, the following error occurs:

The Windows Security Service service on Local Computer started and then stopped. Some services stop automatically if they are not in use by other services or programs.

Or you may receive an error like the following:

SecurityHealthSystray: SecurityHealthSystray.exe - Bad Image

\?\C:\Windows\System32\SecurityHealth\1.0.2207.20002-0\SecurityHealthSSO.dll is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support. Error status 0xc000012f

Cause

The above issues occur if the registry points to an old or non-existent path for the Security Health core files. On Windows 11 22H2, the Security Health Service files are located in the C:\Windows\System32 directory. Here are the module names:

• SecurityHealthAgent.dll
• SecurityHealthCore.dll
• SecurityHealthHost.exe
• SecurityHealthProxyStub.dll
• SecurityHealthService.exe
• SecurityHealthSSO.dll
• SecurityHealthSsoUdk.dll
• SecurityHealthSystray.exe
• SecurityHealthUdk.dll

On some systems, the “CoreLocation” registry value may be pointing to the SecurityHealth platform folder (which causes the problem in 22H2 and higher), such as the one below:

\\?\C:\Windows\System32\SecurityHealth\1.0.2207.20002-0

As a result, the Security Health service tries to load outdated modules and fails to start.

Solution

To resolve the Windows Security Service (“SecurityHealthService“) service startup error, follow these steps:

1. Create a System Restore Point or backup the registry.
2. Download w11-sechealth-location.reg and save it to the desktop.
3. Launch CMD.EXE as TrustedInstaller (using the AdvancedRun utility).
4. In the Ti Command Prompt, run regedit.exe
5. From the File menu in the Registry Editor, click Import… and import the REG file.
6. Exit the Registry Editor.
7. In the Ti Command Prompt, run these commands:

   regsvr32 c:\windows\system32\securityhealthagent.dll
   
   net start securityhealthservice

   Note down the error messages, if any.

INFO: REG file contents

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{E3C9166D-1D39-4D4E-A45D-BC7BE9B00578}]
@="Defender SSO"

[HKEY_CLASSES_ROOT\CLSID\{E3C9166D-1D39-4D4E-A45D-BC7BE9B00578}\InProcServer32]
@="\\\\?\\C:\\Windows\\System32\\SecurityHealthSSO.dll"
"ThreadingModel"="Both"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Security Health\Platform]
"CoreLocation"="\\\\?\\C:\\Windows\\System32"

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Security Health\Updates]

[HKEY_CLASSES_ROOT\AppID\{1D278EEF-5C38-4F2A-8C7D-D5C13B662567}]
"DllSurrogate"="\\\\?\\C:\\Windows\\System32\\SecurityHealthHost.exe"

[HKEY_CLASSES_ROOT\CLSID\{6CED0DAA-4CDE-49C9-BA3A-AE163DC3D7AF}]
"LocalizedString"="@\\\\?\\C:\\Windows\\System32\\SecurityHealthAgent.dll,-12001"

[HKEY_CLASSES_ROOT\CLSID\{6CED0DAA-4CDE-49C9-BA3A-AE163DC3D7AF}\Elevation]
"IconReference"="@\\\\?\\C:\\Windows\\System32\\SecurityHealthAgent.dll,-101"

[HKEY_CLASSES_ROOT\CLSID\{6CED0DAA-4CDE-49C9-BA3A-AE163DC3D7AF}\InprocServer32]
@="\\\\?\\C:\\Windows\\System32\\SecurityHealthAgent.dll"

[HKEY_CLASSES_ROOT\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\InProcServer32]
@="\\\\?\\C:\\Windows\\System32\\SecurityHealthAgent.dll"

[HKEY_CLASSES_ROOT\CLSID\{88866959-07B0-4ED8-8EF5-54BC7443D28C}]
"LocalizedString"="@\\\\?\\C:\\Windows\\System32\\SecurityHealthAgent.dll,-12001"

[HKEY_CLASSES_ROOT\CLSID\{88866959-07B0-4ED8-8EF5-54BC7443D28C}\Elevation]
"IconReference"="@\\\\?\\C:\\Windows\\System32\\SecurityHealthAgent.dll,-101"

[HKEY_CLASSES_ROOT\CLSID\{88866959-07B0-4ED8-8EF5-54BC7443D28C}\InprocServer32]
@="\\\\?\\C:\\Windows\\System32\\SecurityHealthAgent.dll"

[HKEY_CLASSES_ROOT\CLSID\{8E67B5C5-BAD3-4263-9F80-F769D50884F7}]
"LocalizedString"="@\\\\?\\C:\\Windows\\System32\\SecurityHealthAgent.dll,-12001"

[HKEY_CLASSES_ROOT\CLSID\{8E67B5C5-BAD3-4263-9F80-F769D50884F7}\Elevation]
"IconReference"="@\\\\?\\C:\\Windows\\System32\\SecurityHealthAgent.dll,-101"

[HKEY_CLASSES_ROOT\CLSID\{8E67B5C5-BAD3-4263-9F80-F769D50884F7}\InprocServer32]
@="\\\\?\\C:\\Windows\\System32\\SecurityHealthAgent.dll"

[HKEY_CLASSES_ROOT\CLSID\{C8DFF91D-B243-4797-BAE6-C461B65EDED3}\InprocServer32]
@="\\\\?\\C:\\Windows\\System32\\SecurityHealthAgent.dll"

[HKEY_CLASSES_ROOT\CLSID\{DBF393FC-230C-46CC-8A85-E9C599A81EFB}\InprocServer32]
@="\\\\?\\C:\\Windows\\System32\\SecurityHealthAgent.dll"

[HKEY_CLASSES_ROOT\CLSID\{E041C90B-68BA-42C9-991E-477B73A75C90}\InprocServer32]
@="\\\\?\\C:\\Windows\\System32\\SecurityHealthAgent.dll"

[HKEY_CLASSES_ROOT\AppID\{2eb6d15c-5239-41cf-82fb-353d20b816cf}]
@="Windows Security Health Service"
"LocalService"="SecurityHealthService"
"DllSurrogate"=""

[HKEY_CLASSES_ROOT\AppID\{37096FBE-2F09-4FF6-8507-C6E4E1179839}]
"DllSurrogate"="\\\\?\\C:\\Windows\\System32\\SecurityHealthHost.exe"

[HKEY_CLASSES_ROOT\CLSID\{10964DDD-6A53-4C60-917F-7B5723014344}]
"LocalizedString"="@\\\\?\\C:\\Windows\\System32\\SecurityHealthAgent.dll,-12001"

[HKEY_CLASSES_ROOT\CLSID\{10964DDD-6A53-4C60-917F-7B5723014344}\Elevation]
"IconReference"="@\\\\?\\C:\\Windows\\System32\\SecurityHealthAgent.dll,-101"

[HKEY_CLASSES_ROOT\CLSID\{10964DDD-6A53-4C60-917F-7B5723014344}\InprocServer32]
@="\\\\?\\C:\\Windows\\System32\\SecurityHealthAgent.dll"

[HKEY_CLASSES_ROOT\CLSID\{3522D7AF-4617-4237-AAD8-5860231FC9BA}]
"LocalizedString"="@\\\\?\\C:\\Windows\\System32\\SecurityHealthAgent.dll,-12001"

[HKEY_CLASSES_ROOT\CLSID\{3522D7AF-4617-4237-AAD8-5860231FC9BA}\Elevation]
"IconReference"="@\\\\?\\C:\\Windows\\System32\\SecurityHealthAgent.dll,-101"

[HKEY_CLASSES_ROOT\CLSID\{3522D7AF-4617-4237-AAD8-5860231FC9BA}\InprocServer32]
@="\\\\?\\C:\\Windows\\System32\\SecurityHealthAgent.dll"

[HKEY_CLASSES_ROOT\CLSID\{36383E77-35C2-4B45-8277-329E4BEDF47F}\InProcServer32]
@="\\\\?\\C:\\Windows\\System32\\SecurityHealthProxyStub.dll"

[HKEY_CLASSES_ROOT\CLSID\{3CD3CA1E-2232-4BBF-A733-18B700409DA0}\InprocServer32]
@="\\\\?\\C:\\Windows\\System32\\SecurityHealthAgent.dll"

[HKEY_CLASSES_ROOT\CLSID\{45F2C32F-ED16-4C94-8493-D72EF93A051B}]
"LocalizedString"="@\\\\?\\C:\\Windows\\System32\\SecurityHealthAgent.dll,-12001"

[HKEY_CLASSES_ROOT\CLSID\{45F2C32F-ED16-4C94-8493-D72EF93A051B}\Elevation]
"IconReference"="@\\\\?\\C:\\Windows\\System32\\SecurityHealthAgent.dll,-101"

[HKEY_CLASSES_ROOT\CLSID\{45F2C32F-ED16-4C94-8493-D72EF93A051B}\InprocServer32]
@="\\\\?\\C:\\Windows\\System32\\SecurityHealthAgent.dll"

[HKEY_CLASSES_ROOT\CLSID\{5FFAB5C8-9A36-4B65-9FC6-FB69F451F99C}\InprocServer32]
@="\\\\?\\C:\\Windows\\System32\\SecurityHealthAgent.dll"

Note that the above fix is especially applicable for Windows 11 systems that have been upgraded to version 22H2.