question

John555444-1280 avatar image
1 Vote"
John555444-1280 asked Cloeli answered

Windows Defender service crashing

Hi,

I have noticed that the windows defender service seems to be crashing on machines running Windows 10 1909 since around april....

Seems to coincide with the updates.

Does anyone have a fix or is this a known issue?

Errors:

The Windows Defender Antivirus Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Run the configured recovery program.

Faulting application name: MsMpEng.exe, version: 4.18.1911.3, time stamp: 0x2c9b5e9d
Faulting module name: mprtp.dll, version: 4.18.1911.3, time stamp: 0xf2142587

windows-10-network
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

KapilArya avatar image
0 Votes"
KapilArya answered

Hello,

Suggest you to run System File Checker scan:

  1. Search for 'command prompt' using Cortana or Windows Search.

  2. From results, right click on Command Prompt and select Run as administrator.

  3. Type sfc /scannow command and press Enter key.

  4. Let the command complete and then reboot the machine.

If that doesn't works, try these steps:

  1. Search for 'windows powershell' using Cortana or Windows Search.

  2. From results, choose Windows PowerShell and select Run as administrator.

  3. Then type/paste following and press Enter key:

Repair-WindowsImage -Online -RestoreHealth

Let the command complete, restart your system then.

Let us know if this helps!

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

John555444-1280 avatar image
0 Votes"
John555444-1280 answered

All passed with nothing wrong...

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

TeemoTang-MSFT avatar image
0 Votes"
TeemoTang-MSFT answered

Try to in-place upgrade to repair system files issue.
Download Windows Update Assistant from here and follow the guide, after upgrade complete, Windows Defender should be fine.
https://www.microsoft.com/en-au/software-download/windows10


If the Answer is helpful, please click "Accept Answer" and upvote it.
Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

John555444-1280 avatar image
0 Votes"
John555444-1280 answered TeemoTang-MSFT commented

I can't just do an in place upgrade.... I have hundreds of computers all suddenly doing the same since april.... Nothing changed on the machines.

Perhaps there is an issue in the defender updates for machines running 1909...

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

have you configured or installed some software recently? Make sure your clients don't installed additional security software or add-ons

0 Votes 0 ·
AndrewDing-3035 avatar image
0 Votes"
AndrewDing-3035 answered

same issue here, My outlook 365 keep crashing when this error happens.

Faulting application name: MsMpEng.exe, version: 4.18.1911.3, time stamp: 0x2c9b5e9d
Faulting module name: mprtp.dll, version: 4.18.1911.3, time stamp: 0xf2142587
Exception code: 0xc0000409
Fault offset: 0x00000000000842ed
Faulting process id: 0x7370
Faulting application start time: 0x01d793867bec5b33
Faulting application path: C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1911.3-0\MsMpEng.exe
Faulting module path: C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1911.3-0\mprtp.dll
Report Id: 1aae46db-f6d5-4a0f-98b5-ca7d295729bb
Faulting package full name:
Faulting package-relative application ID:

anyone find the issues?

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Cloeli avatar image
0 Votes"
Cloeli answered Cloeli published

Same issue here. Windows Defender keepts shuting itself down on Windows Server 2016. Manual restart of the application is required. Very problematic.

Name der fehlerhaften Anwendung: MsMpEng.exe, Version: 4.18.1911.3, Zeitstempel: 0x2c9b5e9d
Name des fehlerhaften Moduls: mprtp.dll, Version: 4.18.1911.3, Zeitstempel: 0xf2142587
Ausnahmecode: 0xc0000409
Fehleroffset: 0x00000000000842ed
ID des fehlerhaften Prozesses: 0xacc
Startzeit der fehlerhaften Anwendung: 0x01d7a3dd8ccd898f
Pfad der fehlerhaften Anwendung: C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1911.3-0\MsMpEng.exe
Pfad des fehlerhaften Moduls: C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1911.3-0\mprtp.dll
Berichtskennung: bb330788-db09-403a-abca-72b43789f893
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

ChristianJacobsen-8878 avatar image
0 Votes"
ChristianJacobsen-8878 answered ChristianJacobsen-8878 edited

Same problem on newer version of Defender.
Last week its going crazy and crashing sometimes even many times per day
This is happening on servers

Faulting application name: MsMpEng.exe, version: 4.18.2001.7, time stamp: 0x5a75917d
Faulting module name: mprtp.dll, version: 4.18.2001.7, time stamp: 0x3a014281
Exception code: 0xc0000409
Fault offset: 0x000000000008934d
Faulting process id: 0x2ad4
Faulting application start time: 0x01d7ae672a335e43
Faulting application path: C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2001.7-0\MsMpEng.exe
Faulting module path: C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2001.7-0\mprtp.dll
Report Id: efce22cb-c7c4-46db-a86c-b7710325f062
Faulting package full name:
Faulting package-relative application ID:

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

John555444-1280 avatar image
0 Votes"
John555444-1280 answered

I ended up just forcing a platform update for defender, which fixed it. Have since upgraded from 1909, and don't think its a problem on this image!!

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Cloeli avatar image
0 Votes"
Cloeli answered

The problem keeps appearing on Windows Server 2016 (which does not have a platform upgrade available).

As a hotfix, I am running a Windows Task every 5 minutes that checks whether Defender is running and restarts it if required.
Task looks like this:

Program/Script: powershell.exe
Arguments: -command "if((Get-MpComputerStatus | select -expandproperty RealTimeProtectionEnabled) -eq $false) {set-MpPreference -DisableRealtimeMonitoring $false}"

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.