Additional Microsoft Defender tools and services that provide security across various platforms and environments
The behavior described is not documented as a known issue with Microsoft Build of OpenJDK 17 or with Windows Server 2022 in the provided material. However, there are a few concrete checks and mitigations that can be applied on the affected server:
- Verify the keytool binary and JDK installation
- Reinstall Microsoft Build of OpenJDK 17 from a known-good source.
- After reinstall, confirm that
keytool.exeruns from an elevated Command Prompt or PowerShell. - Compare the file size and digital signature of
keytool.exeon the problematic server with the working Windows Server 2022 instance to ensure the binary is not corrupted or modified.
- Check for security or AV interference
- Since the tag mentions Microsoft Defender, check Microsoft Defender or any other security product’s history/quarantine to see if
keytool.exeor related JDK files have been blocked, quarantined, or modified after installation. - If such an event is found, restore the file (if appropriate) and add an exclusion for the JDK installation directory, then test again.
- Since the tag mentions Microsoft Defender, check Microsoft Defender or any other security product’s history/quarantine to see if
- Confirm OS health and updates
- Ensure Windows Server 2022 is fully updated on the affected machine and matches the patch level of the working server.
- If the issue started after a specific update or configuration change, review that change and test whether reverting it (if possible) restores
keytool.exefunctionality.
- Test with a fresh JDK path
- Install Microsoft Build of OpenJDK 17 or 21 into a new directory (do not overwrite the existing one) and run
keytool.exefrom that new path. - If the new installation works while the old one still fails, this points to local corruption or security blocking of the original installation directory.
- Install Microsoft Build of OpenJDK 17 or 21 into a new directory (do not overwrite the existing one) and run
- Compare environment and policies between servers
- Compare Group Policy Objects (GPOs), AppLocker rules, or other application control policies between the working and non-working Windows Server 2022 instances.
- If application control is enabled, ensure
keytool.exeand the JDK folder are allowed.
- As a last resort, consider using a newer JDK
- Microsoft Build of OpenJDK 21 is available and includes enhancements and fixes, including changes related to Windows APIs. Installing and testing with 21 on the affected server can help determine whether the behavior is specific to the 17 installation.
If none of these steps resolve the issue, collecting logs from Microsoft Defender (or other security tools) and Windows Event Viewer (Application and System logs) around the time keytool.exe fails, then opening a support case with Microsoft would be the next step.
References:
- Release notes for the Microsoft Build of OpenJDK
- Install the Microsoft Build of OpenJDK
- Resolved issues in Windows Server 2022
- EnableEUDC API call slows down over time on Windows Server 2022 / Windows 11 - Microsoft Q&A
- How to fix this Event Viewer Crash showing up in my Application Log? - Microsoft Q&A