Windows Defender throwing error Events 7000, 7001

Topic

New Reply

This was just posted by @glnz: Windows Security [Microsoft Defender] has started throwing error messages in Event Viewer, in both 1909 and 2004, appar
[See the full post at: Windows Defender throwing error Events 7000, 7001]

5 users thanked author for this post.

lmacri, jburk07, Elly, mpw, GreatAndPowerfulTech

Reply | Quote

Replies

I am getting errors also.  Seems to have started with platform update that installed when I released metered connection yesterday morning.  Definition updates have followed but may not be compatible with updated platform.  Just a guess this stuff is over my head.

Here are the errors I get:

One website said restart the service.  This is what I got when I tried.

Microsoft Answers has people restarting in recovery mode and resetting their computers.  I’m not doing any of that.  Basically, Microsoft Answers not helpful and suggest Microsoft fix.  Tenforums.com came to same conclusion.  I would not have gone through their complicated instructions.  Glad ball was swatted back to Microsoft’s court.

How vulnerable am I while Windows defender is broken?

HP Pavilion Desktop TP01-0050 – 64 bit
Windows 10 Home Version 22H2
OS build 19045.5608
Windows Defender and Windows Firewall
Microsoft Office Home and Business 2019
-Version 2502(Build 18526.20168 C2R)

2 users thanked author for this post.

jburk07, woody

Reply | Quote

I doubt that you’re vulnerable – and would expect a fix shortly. Even though the weekend is nigh.

2 users thanked author for this post.

jburk07, mpw

Reply | Quote

Not seeing issues here?  Just defender, nothing else installed.

Susan Bradley Patch Lady/Prudent patcher

3 users thanked author for this post.

jburk07, mpw, woody

Reply | Quote

I’m seeing them in Event Viewer, Windows Logs/System.

Error 7000: “The Windows Defender Antivirus Network Inspection System Driver Service failed to start due to the following error: The supplied user buffer is not valid for the requested operation.”

Error 7001: “The Windows Defender Antivirus Network Inspection Service service depends on the Windows Defender Antivirus Network Inspection System Driver service which failed to start because of the following error: The supplied user buffer is not valid for the requested operation.”

2 users thanked author for this post.

jburk07, mpw

Reply | Quote

Some more information if helpful.  Both events, 7000 and 7001, began and are continuing on my computer from 8/6/2020 2:53:55 PM

 

HP Pavilion Desktop TP01-0050 – 64 bit
Windows 10 Home Version 22H2
OS build 19045.5608
Windows Defender and Windows Firewall
Microsoft Office Home and Business 2019
-Version 2502(Build 18526.20168 C2R)

1 user thanked author for this post.

jburk07

Reply | Quote

WIN10 pro 1909 with defender 4.18.2007.8. No abnormal events

2 users thanked author for this post.

jburk07, mpw

Reply | Quote

“pro” may be the operative word here in Win10 pro..  Susan B not seeing anything on her enterprise computers either.

HP Pavilion Desktop TP01-0050 – 64 bit
Windows 10 Home Version 22H2
OS build 19045.5608
Windows Defender and Windows Firewall
Microsoft Office Home and Business 2019
-Version 2502(Build 18526.20168 C2R)

Reply | Quote

Pro at the office and pro at home both not seeing anything.

Susan Bradley Patch Lady/Prudent patcher

1 user thanked author for this post.

mpw

Reply | Quote

I just looked and dont see these errors. WIN10 home 2004.

Barry
Windows 11 v23H2

2 users thanked author for this post.

jburk07, mpw

Reply | Quote

The main question here though is: is Defender not protecting a system, or is it one of those gazillions useless errors that under the line mean not much…? Didn’t see them btw, but use Kasperky. Which might help of course.

Reply | Quote

Does the Defender Updates continue to be pushed if Windows updates is paused? I guess that definition updates would but about about Defender Engine updates.

1 user thanked author for this post.

Microfix

Reply | Quote

Win10Pro 1909.18363.959 No Windows Defender error.

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

1 user thanked author for this post.

jburk07

Reply | Quote

[bbearren]

Fully updated 2004 Windows 10 Pro and I’ve got nothin’.

Always create a fresh drive image before making system changes/Windows updates; you may need to start over!

We all have our own reasons for doing the things that we do with our systems; we don't need anyone's approval, and we don't all have to do the same things.

We were all once "Average Users".

Computer Specs

• This reply was modified 4 years, 8 months ago by bbearren. Reason: clarity

1 user thanked author for this post.

jburk07

Reply | Quote

[lmacri]

I don’t see these errors on my Win 10 Pro v1909 Build 18363.959 with Windows Defender v4.18.2007.8 but Windows Security | Device Security | Core Isolation | Core Isolation Details | Memory Integrity is OFF, and if I open my Local Group Policy Editor (gpedit.msc), navigate to Computer Configuration | Administrative Templates | System | Device Guard and double-click Turn on Virtualization Based Security it is set to NOT CONFIGURED (i.e., VBS is not Enabled). I believe these are the default settings for Win 10 v1909 Pro, so I wouldn’t expect to be affected if Core Isolation/Virtualization Based Security is the cause.
————-
64-bit Win 10 Pro v1909 build 18363.959 * Windows Defender v4.18.2007.8

• This reply was modified 4 years, 8 months ago by lmacri.
• This reply was modified 4 years, 8 months ago by lmacri. Reason: Edit to Win 10 build number

1 user thanked author for this post.

jburk07

Reply | Quote

Interesting. On my 1909 Pro machines, both of which were upgraded from 1903, I have “This setting is managed by your administrator,” and a grayed-out Memory integrity setting “On.”

No Group Policy changes as far as I know.

As noted before, I’m getting the Errors.

IMPORTANT NOTE: I absolutely do NOT advise “normal” Windows users to go spelunking for this. Think of it as a moderately amusing sideshow. It’s obviously a bug in Windows Defender. MS will fix it one of these days. Or weeks. Or months.

4 users thanked author for this post.

jburk07, Elly, mpw, GreatAndPowerfulTech

Reply | Quote

My Windows 10 Home loaded v1909 when I turned it on for the first time 1/28/2020.

Windows Security>Device Security>Core isolation details>Memory Integrity is on.  Must have been that way from the beginning as I have never been here before so I didn’t do it.

And I’m not changing it.  I’ll wait unless advised that my computer is vulnerable and it is dangerous to wait for Microsoft to fix this.

HP Pavilion Desktop TP01-0050 – 64 bit
Windows 10 Home Version 22H2
OS build 19045.5608
Windows Defender and Windows Firewall
Microsoft Office Home and Business 2019
-Version 2502(Build 18526.20168 C2R)

1 user thanked author for this post.

jburk07

Reply | Quote

sheldon wrote:

WIN10 pro 1909 with defender 4.18.2007.8. No abnormal events

I have 3 Win 10 pro machines with same releases of defender and windows.
None of these events.

Byte me!

1 user thanked author for this post.

jburk07

Reply | Quote

There are some indications that a driver for a Western Digital external hard drive is incompatible with the current MS Defender platform.  Go down the thread at MS Answers Community at

https://answers.microsoft.com/en-us/windows/forum/all/windows-defender-antivirus-network-inspection/e3ed244b-6fd1-4a46-9828-1c0ba973dacc

I have a WD external drive, and I wonder whether Woody and mpw have also.

4 users thanked author for this post.

lmacri, woody, jburk07, mpw

Reply | Quote

I have one but only use it once a week to back up files and create system image.  Then unplug it and put it in a safe place.

It has not been pluged in while I have been receiving these errors.

Thanks for the thought though.

HP Pavilion Desktop TP01-0050 – 64 bit
Windows 10 Home Version 22H2
OS build 19045.5608
Windows Defender and Windows Firewall
Microsoft Office Home and Business 2019
-Version 2502(Build 18526.20168 C2R)

Reply | Quote

I do indeed.

If it’s a driver conflict, then the errors may appear whether the drive’s in use or not.

Excellent sleuthing!

1 user thanked author for this post.

jburk07

Reply | Quote

https://community.wd.com/t/unable-to-enable-core-isolation-memory-integrity-due-to-western-digital-driver-windows-10-2004/252131 looks to be the solution.

I don’t understand why people allow any drivers to be installed for a standard USB extrernal hard disk… Obviously no driver needed for normal access to a USB drive.  And as in many cases if you allow bloatware to be installed to your computer it will hit back sooner or later.

Reply | Quote

Anonymous – agree with you that we don’t need the WD bloatware.
But how do we connect the drive so it doesn’t reinstall it?

Reply | Quote

[Alex5723]

I think that after uninstalling WD SES driver and software Windows will use universal USB driver.

I have 3 WD external drives connected, WD SES driver installed, but I use Kaspersky and not Defender.

So the answer is to switch to a much better A/V (Kaspersky, Bitdefender..)

• This reply was modified 4 years, 8 months ago by Alex5723.
• This reply was modified 4 years, 8 months ago by Alex5723.

Reply | Quote

It is probably some autorun stuff factory preloaded to the drive’s factory formatted partition.

Formatting the drive would most probably wipe it out but if you (presumably) have useful data on the drive then look for autorun files in the root folder, open with a text editor and look for paths of some executable file there. Remove the executable or more likely the whole folder containing it will prevent the drivers re-installed.

Reply | Quote

WD drives come with installation software that may run on first connection:

Reply | Quote

Alex – yes – my WD external drive has a partition with an autorun that reinstalls its firmware onto my PC on each reboot, and I am unable to edit anything in that partition.

Reply | Quote

I just removed all WD software and re-formted the drive.

Reply | Quote

Woody – not my sleuthing.  But those of us with WD external drives seem to be stuck.  Unless I’m missing a fix.
Both MS and WD need to work together to fix.

Reply | Quote

MS will most probably blacklist that driver but the response may take time.

It is an especially ugly solution from WD since as some people reports that they found their driver is 7-8 years old and actually made for Win 8.x and still there, keep reinstalling on 10 without any checking of updates at install time or later.

Reply | Quote

Windows Defender Antimalware Client v4.18.2007.8 (1.1.17300.4 engine), v1.321.997.0 definitions, Core isolation OFF, no WD stuff here. Windows Defender Antivirus Network Inspection Service set to Manual, starts fine (normally it is NOT running, it is only triggered and started by the AV itself as needed), no Event Viewer log errors. My 2 cents:

1. Core isolation is a device-dependent feature: it can only be enabled successfully if both the hardware and the Hyper-V configuration/usage requirements are met (see here)
2. First simple thing to try is to update to the latest definitions (currently v1.321.997.0). They can be manually downloaded at https://www.microsoft.com/en-us/wdsi/defenderupdates (note that the links to download the definitions are often slightly behind the latest available definitions; as I write this, the webpage is still offering v1.321.990.0).
3. If problems arise that can be pinpointed solely to the Network Real-Time Inspection component of the product, an alternative to try (instead of reinstalling or rebooting in recovery mode and resetting computers) might be just to scroll down to the bottom of the above mentioned webpage and download and (re)install the NIS updates
   
   (nis_full.exe is rather old, digitally signed March 21, 2018; I haven’t tried or tested this approach at all, but eventually it might be worth trying – if anyone here wants to confirm that, it might be enough and do the trick of replacing the missing core element – library, whatever – that seems to be the root issue reported by some people)
4. An even simpler, trustworthy and proved temporary workaround is simply to rollback to the previously used version (v4.18.2006.10-0).

Reply | Quote

This MIGHT BE caused by a bad, old driver from Western Digital for their external hard drives – although not 100% clear.

Meantime. please go to Unable to Enable Core Isolation Memory Integrity due to Western Digital Driver (Windows 10 2004) – External Drives for PC – WD Community

and complain.

2 users thanked author for this post.

Mele20, lmacri

Reply | Quote

This little program may be worth trying. If the problematic driver shows, you may be able to uninstall it with this package:
https://github.com/lostindark/DriverStoreExplorer

You will need:
DriverStoreExplorer.v0.11.18.zip

This is a powerful program. Make sure you know exactly what you are uninstalling.

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

Reply | Quote

https://www.reddit.com/r/Windows10/comments/hz2kc9/microsoft_defender_realtime_protection_stops/

DefinitelyYou

1 point·1 day ago

Microsoft have now released another antimalware platform update (4.18.2008.4) on the machine that automatically enrolled itself to receive preview updates (the update doesn’t appear on any other machines). This update resolves the issue.

from https://www.reddit.com/r/Windows10/comments/hz2kc9/microsoft_defender_realtime_protection_stops/

Susan Bradley Patch Lady/Prudent patcher

2 users thanked author for this post.

mpw, lmacri

Reply | Quote

4.18.2008.4 does not seem to be provided in MS Update Catalog.  If I’m wrong, please send link.

Reply | Quote

[glnz]

Been away since my initial post was highlighted by Woody.

Seems there’s no fix yet.

I had turned off Memory Integrity to stop the 7000 and 7001 error messages and now it will not turn back on.  (My platform version is 4.18.2007.8.)  I have a WD external drive connected to my Win 10 Pro 64-bit machine (version 1909, updated through July).

Seems everyone is having same problem other than Susan Bradley on her machine that installed a Preview update and a new platform version.

Do I have this right more or less?

• This reply was modified 4 years, 8 months ago by glnz.

Reply | Quote

I’m still on 1909.  I just posted a comment from reddit who indicated it got fixed..  I’m wondering if that is from an insider build number?

Susan Bradley Patch Lady/Prudent patcher

1 user thanked author for this post.

mpw

Reply | Quote

Antimalware Client Version: 4.18.2007.8
Engine Version: 1.1.17300.4
Antivirus Version: 1.321.1325.0
Antispyware Version: 1.321.1325.0

No Windows Defender errors.

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

1 user thanked author for this post.

jburk07

Reply | Quote

This link reports WD External Drive is not the problem causing the errors 7000 and 7001. When Microsoft releases defender platform v 4.18.2008.4 the error problem will be fixed.

https://www.tenforums.com/antivirus-firewalls-system-security/161859-windows-defender-network-inspection-service-fails-start-5.html

 

Hard to understand if author of post is saying Memory Integrity problem will also be solved.  Read it and maybe you will understand what he is saying.

HP Pavilion Desktop TP01-0050 – 64 bit
Windows 10 Home Version 22H2
OS build 19045.5608
Windows Defender and Windows Firewall
Microsoft Office Home and Business 2019
-Version 2502(Build 18526.20168 C2R)

2 users thanked author for this post.

geekdom, lmacri

Reply | Quote

On my Win 10 Pro 64-bit version 1909 (updated through 07-2020) I managed to get
Antimalware Client Version: 4.18.2008.4

But I still cannot turn on Memory Integrity.

I still have my WD external drive hooked up.  The driver for “WD SES Device” is disabled.  My efforts to uninstall that driver fail – it is reinstalled on every boot.

What next?

Thanks.

1 user thanked author for this post.

mpw

Reply | Quote

[Alex5723]

Try by removing WD software from the drive. You don’t need it.

• This reply was modified 4 years, 8 months ago by Alex5723.

Reply | Quote

To deinstall the hard way….

Uninstall as before, do not reboot.

Shut-down with the main-Power-button

Restart  the normal way.

The driver ought to be gone

* _ ... _ *

1 user thanked author for this post.

mpw

Reply | Quote

First of all, I did not think people with Windows 10 Pro had the error events.  Others with Windows 10 Pro report they are not getting error events 7000 and 7001 with Antimalware Client Version: 4.18.2007.8.

I have Windows 10 Home.  I got the error events with Antimalware Client Version: 4.18.2007.8. I never turned off Memory Integrity to stop the error events (7000 and 7001), so the WD SES driver has not prevented Memory Integrity from being on.  Maybe it only prevents turning it back on after it has been turned off.

I guess you could try uninstalling the WD SES driver and unplug the external drive.  Then before you plug it in again and it reinstalls WD SES driver, try to turn on Memory Integrity.  If it turns on, I don’t think it will go off when you plug the external drive in and the SES driver loads again.  It doesn’t on my Windows 10 Home.

Hope this helps.

BTW I still have Antimalware Client Version: 4.18.2007.8, I still have the error events 7000 and 7001 and Memory Integrity is still on on my computer.

HP Pavilion Desktop TP01-0050 – 64 bit
Windows 10 Home Version 22H2
OS build 19045.5608
Windows Defender and Windows Firewall
Microsoft Office Home and Business 2019
-Version 2502(Build 18526.20168 C2R)

Reply | Quote

On my Win 10 Pro 64-bit version 1909 (updated through 07-2020) I managed to get
Antimalware Client Version: 4.18.2008.4

But I still cannot turn on Memory Integrity.

I still have my WD external drive hooked up. The driver for “WD SES Device” is disabled . My efforts to uninstall that driver fail – it is reinstalled on every boot.

What next?

EDIT – I completely UNinstalled the WD SES drivers in Device Manager, but I also had to disconnect the WD drive, reboot AND search for the wdcsam64 drivers and delete them everywhere (including from File Repository, which required taking ownership of the relevant WD subfolder’s security) before I could turn on Memory Integrity. Wow!

Now – what happens if I connect the WD drive again – back to square one?

Reply | Quote

My WD external drive has not turned off Memory Integrity when I plug it in.

HP Pavilion Desktop TP01-0050 – 64 bit
Windows 10 Home Version 22H2
OS build 19045.5608
Windows Defender and Windows Firewall
Microsoft Office Home and Business 2019
-Version 2502(Build 18526.20168 C2R)

Reply | Quote

mpw – have you rebooted and re-checked?  And are you getting the 7000 and 7001 errors again in Event Viewer?

Reply | Quote

I never turned off Memory Integrity.  I never uninstalled the WD SES driver.  I never did anything.  I decided to wait for Microsoft to fix the problem.

I still have Antimalware Client Version: 4.18.2007.8, I still have the error events 7000 and 7001 as of 5:23 AM this morning and Memory Integrity is still turned on on my computer.

I will not be plugging in my WD external drive until tomorrow night before scheduled backup.  I have learned that the WD SES drive is still on my computer even though I can only see it in Device Manager when the external drive is plugged in.  It does not seem to cause problems with Memory Integrity on my computer.

HP Pavilion Desktop TP01-0050 – 64 bit
Windows 10 Home Version 22H2
OS build 19045.5608
Windows Defender and Windows Firewall
Microsoft Office Home and Business 2019
-Version 2502(Build 18526.20168 C2R)

Reply | Quote

@glnz –

Since your post above is also cross posted in the tenforums thread on the tenforums site, please don’t forget to follow the advice you’ve received there from the user “pntless” as well as the guidance from @Fred just above this post. Between the two, I’m sure you’ll get a solution to your driver uninstallation problem, which will hopefully also resolve the issue with the Memory Integrity setting within Windows Defender.

I see you’ve also cross posted your latest update about the successful installation of the driver as well as your follow-up question about what’s next.

I’ve seen keeping an eye on this thread because of upgrading to a new system that will have an internal WD SSD and Win 10 Pro version 2004 on it. Hopefully this issue is solved so that if it occurs on my new system off the bat, I’ll be able to take the appropriate corrective action in case the system builder didn’t.

1 user thanked author for this post.

Fred

Reply | Quote

Just to add, I’m well aware of folks saying that the issue so far only affects folks with externally attached WD drives, but in case it also affects my new system, I want to be able to take action. At this time, I don’t plan to have any externally attached drives, but sometimes you never know.

Reply | Quote

Has Microsoft delivered Antimalware Client Version: 4.18.2008.4 to anyone?  I don’t want to go and get it if it isn’t ready for prime time.  I know it is out there but I don’t know why Microsoft does not send the update to my computer.  I am getting updated definitions but not the new platform that is supposed to fix the event errors 7000 and 7001.

HP Pavilion Desktop TP01-0050 – 64 bit
Windows 10 Home Version 22H2
OS build 19045.5608
Windows Defender and Windows Firewall
Microsoft Office Home and Business 2019
-Version 2502(Build 18526.20168 C2R)

Reply | Quote

Still Antimalware Client Version: 4.18.2007.8

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

1 user thanked author for this post.

mpw

Reply | Quote

Now Antimalware Client Version: 4.18.2008.9

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

1 user thanked author for this post.

mpw

Reply | Quote

Me too.  Just happened.

HP Pavilion Desktop TP01-0050 – 64 bit
Windows 10 Home Version 22H2
OS build 19045.5608
Windows Defender and Windows Firewall
Microsoft Office Home and Business 2019
-Version 2502(Build 18526.20168 C2R)

1 user thanked author for this post.

geekdom

Reply | Quote

[geekdom]

Is the problem fixed at last?

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

• This reply was modified 4 years, 7 months ago by geekdom.

1 user thanked author for this post.

mpw

Reply | Quote

Yes, I believe so.  No new 7000 or 7001 errors since 9/1/2020 8:22:06 PM when latest Microsoft Defender Antivirus antimalware platform – KB4052623 (Version 4.18.2008.9) was installed.  Hooray!

HP Pavilion Desktop TP01-0050 – 64 bit
Windows 10 Home Version 22H2
OS build 19045.5608
Windows Defender and Windows Firewall
Microsoft Office Home and Business 2019
-Version 2502(Build 18526.20168 C2R)

Reply | Quote