"Windows Security Centre service can't be started" W10 Pro

[Lord Voldemort]

Hello people.

My OS continues (after a few months) to claim that the "Windows security centre service can't be started". I've Google'd the issue several times, following guides and tutorials to get it working again but to no avail. I'm hoping someone here knows how to resolve this issue without having to suggest reinstallation of Windows.

[Karla Sleutel]

Which tutorials exactly? Did you follow this guide?

https://support.microsoft.com/en-us/topic/error-message-security-center-service-cannot-be-started-71212762-2d72-9c46-a47d-de84e2584dea

[Lord Voldemort]

7 hours ago, Karla Sleutel said:

Which tutorials exactly? Did you follow this guide?

https://support.microsoft.com/en-us/topic/error-message-security-center-service-cannot-be-started-71212762-2d72-9c46-a47d-de84e2584dea

I've followed at least 10 legitimate guides, including Microsoft's guides. They don't resolve the issue, as I said.

[Dixel]

What does your event log say? Did you read it?

[Dixel]

It may fail to start due to the broken dependencies. Did you disable any other services?

[Vistapocalypse]

The phrase “This setting is managed by your administrator” in red letters at the bottom suggests that Group Policy has been set - if not by you, then most likely by a third-party antivirus program to prevent you from turning Microsoft’s antivirus back on. (This can be done even on Windows editions with no Group Policy UI by creation of registry keys.) My suggestion is to completely uninstall any third-party antivirus programs and use Microsoft’s built-in antivirus in the future.

[Lord Voldemort]

On 11/27/2023 at 5:55 AM, Vistapocalypse said:

The phrase “This setting is managed by your administrator” in red letters at the bottom suggests that Group Policy has been set - if not by you, then most likely by a third-party antivirus program to prevent you from turning Microsoft’s antivirus back on. (This can be done even on Windows editions with no Group Policy UI by creation of registry keys.) My suggestion is to completely uninstall any third-party antivirus programs and use Microsoft’s built-in antivirus in the future.

I've attempted to uninstall MBAM in an attempt at resolving the issue but when no third party AV is installed, I get the same error. I've ran SFC and those DISM restore commands in PS to no avail.

[Vistapocalypse]

13 hours ago, Lord Voldemort said:

I've attempted to uninstall MBAM in an attempt at resolving the issue but when no third party AV is installed, I get the same error.

I don’t think MBAM could be the culprit, although I certainly never paid for MBAM Premium since better antivirus software was available for free (and is included with Windows 10). Very likely you once thought you had completely uninstalled a third-party antivirus (possibly Avast), but it left your system in its present condition. I see you don’t want anyone to suggest reinstalling Windows (which might be a good learning experience for you), so hopefully you know more about editing the registry than I do! This link might give you some ideas. Good luck!

https://answers.microsoft.com/en-us/windows/forum/all/the-setting-is-managed-by-your-administrator/3624d367-7405-471d-a067-4b7e38d0deae

[UCyborg]

sc qc wscsvc

If you run Command Prompt as administrator, type in and run the above command, what does it say? The command queries the service's configuration.

[Lord Voldemort]

On 11/29/2023 at 5:17 PM, Vistapocalypse said:

I don’t think MBAM could be the culprit, although I certainly never paid for MBAM Premium since better antivirus software was available for free (and is included with Windows 10). Very likely you once thought you had completely uninstalled a third-party antivirus (possibly Avast), but it left your system in its present condition. I see you don’t want anyone to suggest reinstalling Windows (which might be a good learning experience for you), so hopefully you know more about editing the registry than I do! This link might give you some ideas. Good luck!

https://answers.microsoft.com/en-us/windows/forum/all/the-setting-is-managed-by-your-administrator/3624d367-7405-471d-a067-4b7e38d0deae

That's a wild speculation considering Avast is awful. But I've never used Avast on this system so this one is a no.

On 11/29/2023 at 6:48 PM, UCyborg said:

sc qc wscsvc

If you run Command Prompt as administrator, type in and run the above command, what does it say? The command queries the service's configuration.

C:\WINDOWS\system32>sc qc wscsvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: wscsvc
        TYPE               : 20  WIN32_SHARE_PROCESS
        START_TYPE         : 4   DISABLED
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Security Center
        DEPENDENCIES       : RpcSs
        SERVICE_START_NAME : NT AUTHORITY\LocalService

C:\WINDOWS\system32>

 

[Dixel]

3 hours ago, Lord Voldemort said:

C:\WINDOWS\system32>sc qc wscsvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: wscsvc
        TYPE               : 20  WIN32_SHARE_PROCESS
        START_TYPE         : 4   DISABLED
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Security Center
        DEPENDENCIES       : RpcSs
        SERVICE_START_NAME : NT AUTHORITY\LocalService

C:\WINDOWS\system32>

 

I'm gonna the captain obvious! It says the service is "DISABLED".

[UCyborg]

I had a feeling that there'll be another reason for not starting, though no guarantee there won't be another obstacle in attempting to re-enable it.

Administrators normally don't have permission to change this service's configuration through the APIs that sc and 3rd party utilities use, but its service registry key might be accessible to administrators, so if you don't mind a reboot after changing settings, you may open Registry Editor (regedit.exe) and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc, where you set Start to 2 and DelayedAutostart to 1, at least those are the defaults.

The other method that can be used and will get the changes applied right away is through System Informer. There's only nightly build, but unless you're heavily involved with the program, you shouldn't notice anything off. If one's familiar with Process Hacker, which is basically its predecessor, one should have known "stable" build really means old build lacking many features developed over time.

When you install it, you have to launch it as TrustedInstaller, so launch it normally as administrator first, then in the menu, choose System->Run..., type in C:\Program Files\SystemInformer\SystemInformer.exe and tick Create this task with TrustedInstaller privileges. Another instance of the program will open, where you can open Services tab, double click wscsvc in the list, change Start type to Auto start and enable Delayed start and save with OK.

On 11/29/2023 at 6:17 PM, Vistapocalypse said:

I see you don’t want anyone to suggest reinstalling Windows (which might be a good learning experience for you), so hopefully you know more about editing the registry than I do!

While some people shun the suggestion to reinstall, they tend to underestimate how borked things can get. The problem in this thread is hopefully on the easier (more obvious side). But say we focus on registry alone, the amount of data that is there (on top, keys also have owner and permissions, the latter could be explicit or inherited), you can't possibly tell with a naked eye if everything is OK.

[NotHereToPlayGames]

9 hours ago, UCyborg said:

The other method that can be used and will get the changes applied right away is through System Informer. There's only nightly build, but unless you're heavily involved with the program, you shouldn't notice anything off. If one's familiar with Process Hacker, which is basically its predecessor, one should have known "stable" build really means old build lacking many features developed over time.

Nice new nugget, thanks.

Though I'm having to stick with an older version (3.0.5578) [3.0.5988 also works].

For some reason, GPU% doesn't work for 3.0.6040 and higher, technically only tried on this one computer so far.  

[Lord Voldemort]

On 12/4/2023 at 10:11 PM, UCyborg said:

I had a feeling that there'll be another reason for not starting, though no guarantee there won't be another obstacle in attempting to re-enable it.

Administrators normally don't have permission to change this service's configuration through the APIs that sc and 3rd party utilities use, but its service registry key might be accessible to administrators, so if you don't mind a reboot after changing settings, you may open Registry Editor (regedit.exe) and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc, where you set Start to 2 and DelayedAutostart to 1, at least those are the defaults.

The other method that can be used and will get the changes applied right away is through System Informer. There's only nightly build, but unless you're heavily involved with the program, you shouldn't notice anything off. If one's familiar with Process Hacker, which is basically its predecessor, one should have known "stable" build really means old build lacking many features developed over time.

When you install it, you have to launch it as TrustedInstaller, so launch it normally as administrator first, then in the menu, choose System->Run..., type in C:\Program Files\SystemInformer\SystemInformer.exe and tick Create this task with TrustedInstaller privileges. Another instance of the program will open, where you can open Services tab, double click wscsvc in the list, change Start type to Auto start and enable Delayed start and save with OK.

While some people shun the suggestion to reinstall, they tend to underestimate how borked things can get. The problem in this thread is hopefully on the easier (more obvious side). But say we focus on registry alone, the amount of data that is there (on top, keys also have owner and permissions, the latter could be explicit or inherited), you can't possibly tell with a naked eye if everything is OK.

Start was "4" and "DelayedAutostart" was "1".

I do not wish to reinstall Windows because I have so much stuff on this OS installation that it'd take far too long to put back on. I don't have enough space to make backups of everything either. It's not at all because I've never done it before, on the contrary, many times in the past. One should not be expected to reinstall Windows when they bump into a problem - that is ill advice.

 

EDIT: Everything to do wiht Windows Defender and Security service in registry is disabled and I'm unable to enable or start them.

Edited December 6, 2023 by Lord Voldemort

[UCyborg]

I understand that, but you won't be able to change that service's configuration without becoming TrustedInstaller first. Some interesting reading:

https://www.tiraniddo.dev/2017/08/the-art-of-becoming-trustedinstaller.html

While you don't need to concern yourself with technicalities in that post, you will need System Informer or another utility that makes it easy to run any program in the context of TrustedInstaller (aka NT SERVICE\TrustedInstaller). It's a special service account that has full permissions over various system objects that administrator accounts or more precisely the Administrators group don't.

I simply suggested running System Informer itself as TrustedInstaller as that program allows changing services' configuration, but if you wanted, you could run also run Windows' services.msc as TrustedInstaller, then you should be able to change the configuration of those services with said utilities as well, at least assuming the program that disabled them didn't mess with the permissions.

System Informer also allows you to view and change permissions for each service, if you open any service on Services tab and click Permissions. There, you should see in the case of both Security Center service Windows Security Service (at least that's how they're called in US English version of Windows) that Administrators group doesn't have either Modify Configuration or Stop permission.

But TrustedInstaller does.

And the pictures from System Informer showing default startup type for both services in question:

At least that's how it should be in Win10 builds from the last 3 years or so...sometimes they change some services' configuration with newer builds.

On 12/5/2023 at 9:15 AM, NotHereToPlayGames said:

For some reason, GPU% doesn't work for 3.0.6040 and higher, technically only tried on this one computer so far.  

Including the most recent one? It's updated quite often so oddities can come and go.

Edited December 7, 2023 by UCyborg