Windows 11
The script identifies Windows 11 as build/version 10.0.22000 or newer and runs Get-AppxPackage Microsoft.SecHealthUI -AllUsers | Reset-AppxPackage.
Windows Security Repair Utility
Windows Security Fix
Windows Security Fix is a free PowerShell repair utility designed to restore Microsoft Defender and the Windows Security interface toward normal Windows operation when policy settings, app registration, service configuration, or Defender WMI components are damaged or misconfigured.
This is an active repair/reset tool. It removes Microsoft Defender policy keys and changes service startup configuration. Review the behavior below before running it, especially on work, school, or otherwise managed PCs where security policy may be intentionally enforced.
Repair Sequence
Five major repair stages
01Remove DisableAntiSpyware
02Repair SecHealthUI
03Set Services Automatic
04Clear Defender Policies
05Check Defender WMI
Registry Repair
Removes DisableAntiSpyware when present
The first repair step runs the Windows REG command against:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
If the value exists, it is deleted. If the REG command reports that the value is not present, the script marks the step as skipped with no action needed.
Windows Security App
Different repair logic for Windows 10 and Windows 11
Windows 10
The script first launches windowsdefender: and waits three seconds to see whether the Windows Security UI process starts successfully.
If Windows 10 launches successfully
If SecHealthUI is detected, the test instance is stopped and the reset/re-registration step is skipped.
If Windows 10 launch fails
The script searches C:\Windows\SystemApps for the Microsoft.SecHealthUI system-app folder and re-registers its AppxManifest.xml with Add-AppxPackage.
Defender Services
Sets core security services to Automatic
Windows Security Fix attempts to set the startup type of three services to Automatic:
WinDefend
The Microsoft Defender Antivirus service.
SecurityHealthService
The Windows Security Health service used by Windows Security status and health reporting.
wscsvc
The Windows Security Center service.
Errors are suppressed
Each Set-Service call uses -ErrorAction SilentlyContinue, so Windows can reject a protected or unsupported startup-type change without displaying that individual error.
The script changes startup types but does not explicitly run
Start-Service for these three services.
Group Policy Cleanup
Removes Defender policy registry trees
After the individual DisableAntiSpyware value check, the current script recursively removes both of these policy locations when present:
- HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender
- HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Antivirus
This is broader than deleting one value. Any Defender configuration stored under those local policy registry trees can be removed. On a managed PC, organization-enforced settings may later return through Group Policy, MDM, or other management systems.
Defender WMI
Checks the Microsoft Defender WMI namespace
The script queries root\Microsoft\Windows\Defender with Get-WmiObject -List. If the namespace responds successfully, the script reports that WMI re-registration is not required.
If the WMI query fails, the repair path attempts to compile the Defender provider files with:
- mofcomp.exe "%programfiles%\Windows Defender\MpProvider.mof"
- mofcomp.exe "%programfiles%\Windows Defender\MpProvider.mfl"
How To Run
Launching Windows Security Fix
- Download and extract Windows Security Fix.zip.
- Run Run Me.bat.
- The launcher starts PowerShell with -ExecutionPolicy Bypass and requests administrator elevation through UAC.
- The DisableAntiSpyware policy value is removed if present.
- The Windows Security app is reset or re-registered according to the detected Windows version and app state.
- Core Windows security service startup types are set to Automatic where Windows permits the change.
- Defender-related local policy registry trees are removed if present.
- The Microsoft Defender WMI namespace is checked and the provider files are recompiled if the check fails.
- The script reports completion and notes that a restart may be necessary.
- Press Enter to close the PowerShell window.
The included Read Me notes that Windows 11 may display a “Windows protected your PC” SmartScreen message because the script was downloaded. Review the files before choosing “More info” and “Run anyway.”
Transparency
What the current script does and does not do
Designed to restore Defender
The script removes settings that can disable or interfere with Microsoft Defender and repairs Windows Security components. It is not designed to disable antivirus protection.
No third-party antivirus installation
The current script does not install another antivirus product or security suite.
No web requests or uploads
The PowerShell script contains no download, upload, API, or remote-communication logic.
No automatic restart
It may recommend restarting the PC, but it does not issue a restart command itself.
FAQ
Frequently asked questions
Does this disable Microsoft Defender?
No. The current repair logic removes disable/interference policies and repairs Defender/Windows Security components.
Does it remove only DisableAntiSpyware?
No. That value is handled first, but the script later removes the broader Defender and Defender Antivirus policy registry trees as well.
How is Windows 11 repaired?
The Windows Security Appx package is reset with Reset-AppxPackage.
How is Windows 10 repaired?
The script first tests whether Windows Security launches. If that test fails, it attempts to re-register SecHealthUI from its Appx manifest.
Does it restart security services?
No explicit Start-Service command is used. The script sets the startup type of WinDefend, SecurityHealthService, and wscsvc to Automatic where possible.
Does it require a reboot?
Not always, but the script reports that a restart may be needed after the repair.