I uninstalled, then reinstalled Defender Antivirus on Windows Server 2019, now the powershell commands for get-mp* don't work!

Komoroske, Gina 386 Reputation points
2021-12-02T17:32:15.41+00:00

In troubleshooting why a small handful of our Windows Server 2019 machines are not updating their virus signatures, someone suggested uninstalling it and reinstalling it. So I did that through the add/remove features option, doing a reboot between each. The 4 (out of approximately 12 not updating) I did this on I no longer can do a get-mpcomputerstatus or get-mppreference on. There is no error, just comes back empty. One other note, we use a WMI query to get a nice consolidated report of all servers and their signature info, and now on those servers I reinstalled Defender on, they report back 'no data.' One example is this: selects "AntivirusSignatureAge FROM MSFT_MpComputerStatus" of wmis "ROOT\Microsoft\Windows\Defender"

Again, after the uninstall/reinstall, I can no longer get data using WMI calls or through a manual get-mp* command. How can I get that working again, any ideas?

Thanks in advance, Gina

Windows for business | Windows Server | User experience | Other
0 comments No comments
{count} votes

Accepted answer
  1. Komoroske, Gina 386 Reputation points
    2021-12-02T21:12:55.07+00:00

    I answered my own question. I had to install all the defender updates, then I was able to use the powershell commands!

    0 comments No comments

1 additional answer

Sort by: Most helpful
  1. Limitless Technology 39,931 Reputation points
    2021-12-03T09:13:45.337+00:00

    Hello KomoroskeGina,

    There is a possibility that the WMI repository is corrupted. Please run the next BAT script on the affected server:

    @Echo off
    sc config winmgmt start= disabled
    net stop winmgmt /y
    %systemdrive%
    cd %windir%\system32\wbem
    for /f %%s in ('dir /b *.dll') do regsvr32 /s %%s
    wmiprvse /regserver
    winmgmt /regserver
    sc config winmgmt start= auto
    net start winmgmt
    for /f %%s in ('dir /s /b *.mof *.mfl') do mofcomp %%s

    Reboot and test.

    If continues failing, I recommend the next article and guide to proceed with further troubleshooting:

    https://techcommunity.microsoft.com/t5/ask-the-performance-team/wmi-repository-corruption-or-not/ba-p/375484

    ----------------------------------------------------------------------------------------------------------------------------------------------------------

    --If the reply is helpful, please Upvote and Accept as answer--

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.