Windows Defender won't start: 0x80070424 fix

Quick answer for advanced users

Run sc create WinDefend binPath= "%systemroot%\system32\svchost.exe -k secsvcs -p" start= auto as admin, then sc start WinDefend. Reboot after. That re-registers the missing service.

Why this error happens

Error 0x80070424 means the Windows Defender service (WinDefend) doesn't exist or its image path is corrupt. This typically happens after you uninstall a third-party antivirus (Norton, McAfee, Avast) that removed the service reference, or after a failed Windows update. You might also see this after a malware removal tool nuked the service entry as part of cleanup. The service itself is still on disk — MpSvc.dll hasn't gone anywhere — but the SCM (Service Control Manager) has no record of it.

The reason step 1 below works is that sc create rebuilds that missing service entry in the registry under HKLM\SYSTEM\CurrentControlSet\Services\WinDefend. Without it, Windows Security Center can't start the real scanning engine.

Fix steps

1. Open Command Prompt as Administrator. Press Win+X, select "Terminal (Admin)" or "Command Prompt (Admin)" on older builds.
2. Re-register the WinDefend service. Copy-paste this exact line:

   sc create WinDefend binPath= "%systemroot%\system32\svchost.exe -k secsvcs -p" start= auto

   Type it exactly — note the space after binPath= and start=. The SCM parser is strict about them.
3. Start the service. Run:

   sc start WinDefend

   You should see SERVICE_START_PENDING then RUNNING. If it fails with 1053 or 1068, reboot first, then retry step 3.
4. Verify in Windows Security. Open Settings > Privacy & Security > Windows Security > Open Windows Security. The shield icon should show green. Click "Virus & threat protection" — if it says "No active antivirus", click "Turn on".

Alternative fixes if the main one fails

Fix 1: Repair using DISM and SFC

If sc create succeeds but the service crashes on start, system files might be busted. Run these in order:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

Fix 2: Remove leftover third-party AV bloatware

Norton and McAfee leave kernel drivers that block Defender from registering. Use the official removal tool for your old AV. For Norton, it's the Norton Removal Tool. For McAfee, MCPR.exe. Run it, reboot, then repeat the sc create step.

Fix 3: Direct registry repair (advanced)

If sc commands fail with permission errors, the service entry might be locked by a malware rootkit. Boot into Safe Mode with Networking, open Regedit, navigate to HKLM\SYSTEM\CurrentControlSet\Services\WinDefend. If the key is missing, create it. Set these values:

DisplayName: Windows Defender Antivirus Service
ImagePath: %systemroot%\system32\svchost.exe -k secsvcs -p
Start: 2
Type: 0x10 (own process)

Prevention tip

Before uninstalling any third-party antivirus, use the vendor's official removal tool — not just Add/Remove Programs. Those tools cleanly remove kernel drivers and service entries. After uninstall, reboot twice. Then run sfc /scannow to catch any orphaned references. This keeps Defender's service entry intact and saves you from the 0x80070424 headache later.