Server 2019 – Windows-Defender feature fails 0x80073701, missing deployment 13754f4c… 10.0.17763.1075 (Package_4045_for_KB4570333)

Hi,

On a production Windows Server 2019 Standard (build 17763.9245), installing the Windows-Defender feature fails with 0x80073701 (ERROR_SXS_ASSEMBLY_MISSING). An in-place upgrade or reinstall is not an option for this server.

CBS.log:

ICSITransaction_PinDeployment(a = 13754f4cdc770d92f454ba04197b360d, version 10.0.17763.1075, arch amd64, nonSxS) → ERROR_SXS_ASSEMBLY_MISSING
Failed to pin deployment while resolving Update: Package_4045_for_KB4570333~31bf3856ad364e35~amd64~~10.0.1.7.4570333-7063_neutral

Findings so far:

• DISM /ScanHealth reports no corruption. The payload of the superseded 2020 components appears to have been scavenged while the Defender feature was disabled.
• The CBS registry has 1192 KB4570333 packages at 0x50 and 81 at 0x40 (Staged).
• Other deployments needed for the Defender feature: 6550234a…(.1075), 2dac243e…(.1131), 7c4d6006…(.1131), 2b48fd84…(.831), 761c81c8…(.831), b287d603…(.529).
• A server built from a newer image has no KB4570333 packages and installs Defender without problems.

On another server with the same issue (now decommissioned) I tried the following, without success: setting the 0x40 packages to 0x50, DISM /StartComponentCleanup /ResetBase, Enable-Feature with /Source pointing to an expanded KB4577069 (which contains the 1075 manifest), and re-adding the KB4577069 package. This server has not been modified.

More servers are affected, so a fix that can be reused would be much appreciated.

Thank you very much!