Virus & Threat Protection missing from Windows Security

[Agonizel]

Hi Community,

I'm supposed to install a program called TestWe for my college exams, but it does not work because of this error: Operation did not complete successfully because the file contains a virus
I know I can easily fix this by disabling Real-Time protection, so I consult Virus & Threat Protection on my start menu, but it does not work because of this error: Your IT Administrator has limited access to some areas of this app. Consult IT Helpdesk (...)
So I figure I gotta go to gpedit.msc > Computer configuration > Administrative Templates > Microsoft > Windows Defender Security and turn off windows defender. Then I gotta go to windows defender security and restart Virus & Threat Protection, but it does not work because it doesn't appear. 
So I google the issue and found this recent solution https://answers.microsoft.com/en-us/protect/forum/all/virus-threat-protection-is-missing-from-windows/15d32fa1-c5e8-453b-a9f6-22da0bb36eea, I then apply the contents of the OP but it does not work.

I then apply the contents of the OP's follow-up comment addressing the fact that it does not work. But that didn't work either.

Turns out the OP of said post revised the fix: https://answers.microsoft.com/en-us/protect/forum/all/virus-threat-protection-is-missing-in-windows/eb3e047c-35e7-4eab-9382-117340e758fb

So I apply the code into the command prompt (powershell), but it does not work. Virus & Threat Protection just won't appear.

This is frankly ridiculous, I just need to de-activate real-time protection for god's sakes. I even upgraded to Windows Pro so I'm not in S Mode, but that doesn't change a thing.

Anybody has a fix for this?

Thanks!
 

[AshRiver]

Did u restart pc?

[Agonizel]

2 minutes ago, AshRiver said:

Did u restart pc?

hahahahahahahahaha WHAT.

Yes ofcourse! 

[Oshino Shinobu]

By the looks of things, you're part of a domain, seeing and group policy is being used (unless it's all local group policy). I'd imagine Virus and Threat Protection are being hidden via group policy if they're not showing. 

 

I'd advise checking RSOP for Computer Configuration: Administrative templates > Windows components > Windows Security > Virus and threat protection > Hide the Virus and threat protection area

[Agonizel]

9 minutes ago, Oshino Shinobu said:

Administrative templates > Windows components > Windows Security > Virus and threat protection > Hide the Virus and threat protection area

I effectively did that, and as I said, it does not work.

The computer is privately owned, self-build and it's in my flat on a privately owned internet connection.

Thanks for your comment though

EDIT: @Oshino Shinobu I have tried re-creating this solution that was documented back in 2019. But that option does not appear anymore for me. They replaced Windows Defender Security with Windows Defender Smartscreen which is entirely different. It does not contain "Hide the Virus & Threat protection" option. Hence why I mainly based myself on the post I linked to that are much more recent.

It's like Microsoft pro-actively blocks it users from accessing Virus & Threat Protection

[Oshino Shinobu]

14 minutes ago, Agonizel said:

I effectively did that, and as I said, it does not work.

The computer is privately owned, self-build and it's in my flat on a privately owned internet connection.

Thanks for your comment though

I assume it's not configured in RSOP then? 

 

The only time I'd expect to see that message is if it's blocked via group policy, or perhaps through tamper protection on WIndows Security, though if you're an administrator, you should be able to see the settings even if tamper protection were on. 

 

EDIT: If you have any other anti-virus software installed, uninstall it and try. I'd also suggest creating a new profile on the PC and see if there's any difference in what you can access to see if it's somehow related to your account.

[Kilrah]

16 minutes ago, Agonizel said:

It's like Microsoft pro-actively blocks it users from accessing Virus & Threat Protection

Microsoft doesn't, but it looks like your organization does, probably for good reasons (e.g your school domain enforces this).

 

Are you sure you got the app from a trusted source? It might actually contain a virus if it was distributed by some random site.

[Oshino Shinobu]

21 minutes ago, Agonizel said:

I effectively did that, and as I said, it does not work.

The computer is privately owned, self-build and it's in my flat on a privately owned internet connection.

Thanks for your comment though

EDIT: @Oshino Shinobu I have tried re-creating this solution that was documented back in 2019. But that option does not appear anymore for me. They replaced Windows Defender Security with Windows Defender Smartscreen which is entirely different. It does not contain "Hide the Virus & Threat protection" option. Hence why I mainly based myself on the post I linked to that are much more recent.

It's like Microsoft pro-actively blocks it users from accessing Virus & Threat Protection

It's not called Windows Defender Security. It's Windows Security.

 

 

 

EDIT: Hold on, might have misread your edit.

 

EDIT 2: The registry location on the newer fix you linked to exists on my system (Windows 10 1903). AFAIK, the registry entry should be available on Windows 10 1709 and up. 

[Agonizel]

6 minutes ago, Kilrah said:

organization does, probably for good reasons (e.g your school domain enforces this

Yeah but I'm in a private flat, with privately owned self-built desktop PC with my own privately owned internet connection... I'm the administrator

[Agonizel]

4 minutes ago, Oshino Shinobu said:

It's not called Windows Defender Security. It's Windows Security.

Right, my bad. I checked and disabled both of the settings. Virus & Threat Protection remains hidden.

[Oshino Shinobu]

4 minutes ago, Agonizel said:

Right, my bad. I checked and disabled both of the settings. Virus & Threat Protection remains hidden.

Restart for the computer policy to reapply and check. 

 

Are you the only administrator account on the PC? I'd try creating another account to see if you can see it on that to rule out any account related issues. 

 

EDIT: Also, did you check the registry key manually or just apply it through powershell? If tamper mode is indeed turned on, it can prevent the registry from being changed. I'd check the registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Virus and threat protection to make sure the UI Lockdown isn't there. 

 

For reference, my registry for Virus and threat protection is empty other than the default key. 

[Agonizel]

11 minutes ago, Oshino Shinobu said:

Are you the only administrator account on the PC? I'd try creating another account to see if you can see it on that to rule out any account related issues. 

I am. Still created a new admin account, still the same thing.

I noticed this. I'm a particular, what organization is Windows talking about?

 

11 minutes ago, Oshino Shinobu said:

For reference, my registry for Virus and threat protection is empty other than the default key. 

I'll check it out. EDIT: checked it out, it was empty aside from default

[Oshino Shinobu]

Just now, Agonizel said:

I am. Still created a new admin account, still the same thing.

I noticed this. I'm a particular, what organization is Windows talking about?

 

I'll check it out

It's generic, generally for group policy, but it can also simply be things like active hours configurations. It says the same thing if you've got any setting configured via group policy from your own domain or a work domain. 

 

Did you do the install of Windows on the PC or was it installed prior? You mentioned moving to Pro so you weren't in S mode. It could be a weird left over from S mode. 

 

I'd click on View configured update policies under windows update to get an idea of where some policies may be coming from. 

 

I can see my configured group policy for windows update. Do you get that message in Windows security anywhere? I have Windows Defender disabled via group policy but don't see the message. 

 

[Kilrah]

9 minutes ago, Agonizel said:

I noticed this. I'm a particular, what organization is Windows talking about?

This will show up with certain popular tricks like disabling updates. You didn't do some tweaks with OOSU10 or other similar things to disable some aspects of Win10 by any chance?

[Agonizel]

2 minutes ago, Oshino Shinobu said:

Did you do the install of Windows on the PC or was it installed prior?

The PC was self-built and the windows license I'm using had been bought way back when it was still windows 7. It has been hopping from SSD to SSD into what's my PC now. I re-installed windows two weeks ago as I changed my GPU.

 

3 minutes ago, Oshino Shinobu said:

You mentioned moving to Pro so you weren't in S mode. It could be a weird left over from S mode. 

I had a windows home license before going pro

 

 

4 minutes ago, Oshino Shinobu said:

'd click on View configured update policies under windows update to get an idea of where some policies may be coming from.

Here's what I got, I do not know what it means

[Agonizel]

1 minute ago, Kilrah said:

You didn't do some tweaks with OOSU10 or other similar things to disable some aspects of Win10 by any chance?

No, I didn't do any of those things. I had re-installed windows 2-3 weeks ago and left everything by default

[Kilrah]

https://superuser.com/questions/1489474/how-to-remove-configured-windows-10-update-policies

 

Seems to match your case, indeed caused by being linked to a school account

[Kilrah]

BTW before trying to run this thing you should really at least submit it to VirusTotal to check.

[Agonizel]

6 minutes ago, Kilrah said:

being linked to a school account

But how am I linked to the school? I'm in a privately owned flat, with a private and self-built desktop computer and a self-installed windows license on a broadband connection from a private provider?

I'm also using a local administrator account. So my question is, how am I linked to the school?

 

5 minutes ago, Kilrah said:

before trying to run this thing you should really at least submit it to VirusTotal to check.

The link to the TestWe software was sent by email by the college administration and friends of mine have already succesfully installed it

[Kilrah]

Just now, Agonizel said:

how am I linked to the school?

Can be just a login to have access to the school network, your school email account etc. The post I linked to tells you where to go to remove it, if you go there you'll likely see what it is...

[Agonizel]

6 minutes ago, Kilrah said:

Can be just a login to have access to the school network, your school email account etc. The post I linked to tells you where to go to remove it, if you go there you'll likely see what it is...

You may be right, I'm checking this out! Thanks man

[Oshino Shinobu]

5 minutes ago, Agonizel said:

You may be right, I'm checking this out! Thanks man

Seems like that's it to me. 

 

Oh boy, now to read up on MDM, might be useful for work.

[Oshino Shinobu]

Found the policy in MDM that's likely active:

 

./Device/Vendor/MSFT/Policy/Config/WindowsDefenderSecurityCenter/DisableVirusUI

 

https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter

[Agonizel]

14 minutes ago, Oshino Shinobu said:

Found the policy in MDM that's likely active:

 

./Device/Vendor/MSFT/Policy/Config/WindowsDefenderSecurityCenter/DisableVirusUI

 

https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter

Alright, sounds promising! could you explain what I've got to do as if I were 5 years old?

[Kilrah]

Read the bottom of the post I linked to where it tells you where to go in settings...

What he posted is him figuring out the technical info behind it, not relevant to you.