I uninstalled, then reinstalled Defender Antivirus on Windows Server 2019, now the powershell commands for get-mp* don't work!

Question

In troubleshooting why a small handful of our Windows Server 2019 machines are not updating their virus signatures, someone suggested uninstalling it and reinstalling it. So I did that through the add/remove features option, doing a reboot between each. The 4 (out of approximately 12 not updating) I did this on I no longer can do a get-mpcomputerstatus or get-mppreference on. There is no error, just comes back empty. One other note, we use a WMI query to get a nice consolidated report of all servers and their signature info, and now on those servers I reinstalled Defender on, they report back 'no data.' One example is this: selects "AntivirusSignatureAge FROM MSFT_MpComputerStatus" of wmis "ROOT\Microsoft\Windows\Defender"

Again, after the uninstall/reinstall, I can no longer get data using WMI calls or through a manual get-mp* command. How can I get that working again, any ideas?

Thanks in advance, Gina

Answer 1

I answered my own question. I had to install all the defender updates, then I was able to use the powershell commands!

Answer 2

Hello KomoroskeGina,

There is a possibility that the WMI repository is corrupted. Please run the next BAT script on the affected server:

@Echo off
sc config winmgmt start= disabled
net stop winmgmt /y
%systemdrive%
cd %windir%\system32\wbem
for /f %%s in ('dir /b *.dll') do regsvr32 /s %%s
wmiprvse /regserver
winmgmt /regserver
sc config winmgmt start= auto
net start winmgmt
for /f %%s in ('dir /s /b *.mof *.mfl') do mofcomp %%s

Reboot and test.

If continues failing, I recommend the next article and guide to proceed with further troubleshooting:

https://techcommunity.microsoft.com/t5/ask-the-performance-team/wmi-repository-corruption-or-not/ba-p/375484

----------------------------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept as answer--