Defender Antivirus Network Inspection Service is Failing Since Windows 10 2004 Update

Defender Antivirus Network Inspection Service Fails to Start

Since Windows 10 2004 update many people are reporting the Microsoft Defender Antivirus Network Inspection System Driver service failing to start.

You can check to see if Defender Antivirus Network Inspection Service is running by opening task manager and checking the Services tab.

You should see service name WdNisSvc as Running.  If this service is stopped then your Windows 10 installation is affected by this bug.

Defender Antivirus Network Inspection Service Fails to Start

If your service is stopped then right click it and choose start.  If the service still doesn’t start then check your event viewer logs at Windows Logs > System.

Look for event ID 26, 7000 and 7001 for details.

If you are affected by the bug event ID 26 will show:

The description for Event ID 26 from source Application Popup cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

\SystemRoot\system32\drivers\wd\WdNisDrv.sys failed to load

The message resource is present but the message was not found in the message table

The Microsoft Defender Antivirus Network Inspection Service service depends on the Microsoft Defender Antivirus Network Inspection System Driver service which failed to start because of the following error:
The supplied user buffer is not valid for the requested operation.

Defender Antivirus Network Inspection Service Fails to Start

We tested this service on several Windows 10 installations to identify the cause of the  problem and only found it occurring on Windows 10 installations that have Memory integrity turned on in the Core Isolation section of Windows Security settings.

Defender Antivirus Network Inspection Service Fails to Start

To get the Microsoft Defender Antivirus Network Inspection System Driver service working again we had to disable the Memory integrity option and reboot the machine.

You can find this setting at Windows Security > Device Security > Core Isolation

We’ve provided feedback to Microsoft but haven’t received any official response at the time of writing this article.

LEAVE A REPLY

Please enter your comment!
Please enter your name here