Windows Security stuck on logo; SecurityHealthService starts then stops, KB5007651 repeatedly reinstalls on Windows 11 25H2

Emre Anlan 0 Reputation points
2026-09-17T18:12:35.94+00:00

I am using Windows 11 25H2, build 26200.9457.

Windows Security does not open properly. It stays on the logo screen, and Event Viewer shows:

SecHealthUI.exe
Event ID 1002 - Application Hang

SecurityHealthService also does not stay running. When I start it manually:

STATE : START_PENDING

and a few seconds later:

STATE : STOPPED
WIN32_EXIT_CODE : 0
SERVICE_EXIT_CODE : 0

So the service exits cleanly instead of crashing.

What I have already checked/tried:

  • RpcSs and wscsvc are running.
  • SecurityHealthService.exe exists and has a valid Microsoft signature.
  • Reset Microsoft.SecHealthUI.
  • Ran SecurityHealthSetup.exe as Administrator.
  • Rebooted.
  • Kaspersky 21.26 is installed, but the same issue happens even when protection is paused.
  • Old Kaspersky 21.24/21.25 leftovers were removed; no change.
  • Current SecurityHealth platform folder is still:
C:\Windows\System32\SecurityHealth\10.0.29510.1001-0
  • SecHealthUI version is:
1000.26100.8036.0

There is also a Windows Update issue with KB5007651. Windows Update repeatedly offers:

Update for Windows Security platform - KB5007651
Version 10.0.27703.1006

It shows as completed, but appears again after checking for updates.

I also manually downloaded the newer x64 package:

KB5007651 version 10.0.29628.1000

The installer returns ExitCode 0, but the SecurityHealth platform folder does not update and remains on 10.0.29510.1001-0.

I also captured the issue with ProcMon. SecurityHealthService.exe starts several times, runs for about 0.12 seconds, successfully loads the SecurityHealth DLLs, then exits with status 0. ProcMon shows:

  • no ACCESS DENIED for the service
  • no failed DLL loads
  • no obvious missing files
  • no Kaspersky interaction before the service exits

This makes me suspect a Windows Security platform / KB5007651 servicing or registration problem rather than Kaspersky or file permissions.

Is there a supported way to repair/reset the Windows Security platform or KB5007651 servicing state without reinstalling Windows?

Windows for home | Windows 11 | Security and privacy
0 comments

2 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Ramesh 182K Reputation points Volunteer Moderator
    2026-09-18T03:36:03.4366667+00:00

    Please check the integrity of all files in this folder:

    C:\Windows\System32\SecurityHealth\10.0.29510.1001-0

    From PowerShell, run:

    gci "C:\Windows\System32\SecurityHealth\10.0.29510.1001-0\*"  -Include *.exe, *.dll | Get-AuthenticodeSignature

    Post the output.

    Was this answer helpful?

    0 comments
  2. Clary-N 16,550 Reputation points Microsoft External Staff Moderator
    2026-09-18T01:26:49.4266667+00:00

    Hi Emre Anlan,

    Thanks for sharing such detailed findings. Do you remember whether this started after a specific Windows update or the upgrade to 25H2? Also, have you already run DISM and SFC?

    Since KB5007651 keeps returning, I suggest resetting the Windows Update components to clear any stuck update files or registration state. Please open Command Prompt as administrator, then run these commands one at a time:

    net stop bits
net stop wuauserv
ren %systemroot%\softwaredistribution softwaredistribution.bak
ren %systemroot%\system32\catroot2 catroot2.bak
net start bits
net start wuauserv

    Restart the PC afterward, then check for updates again. These commands follow Microsoft’s documented advanced troubleshooting method for refreshing the Windows Update folders.

    If the issue remains, the next supported option would be Settings > System > Recovery > Fix problems using Windows Update > Reinstall now. This repairs Windows while keeping your files, apps and settings. Please back up your important files first as a precaution.

    Let me know whether the Windows Security platform version changes after completing the reset.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.