Microsoft Defender Not Running and Unexpected Administrator Account

Preserve evidence for user123, scan with Microsoft Safety Scanner, clear any remaining McAfee registration, and then reset the Microsoft Defender platform using its newest installed platform directory.

1. Investigate user123 before deleting it

Keep the account disabled for now. user123 is not a standard Windows account; Windows’ built-in administrative account is named Administrator by default. Limit membership in the Administrators group because its members have full control of the device.^1^

Open Windows PowerShell as administrator—not 32-bit PowerShell—and run:

Get-LocalUser -Name "user123" |
  Format-List Name,Enabled,Description,SID,PrincipalSource,
              PasswordLastSet,LastLogon

Get-LocalGroupMember -Group "Administrators"

net user user123

Get-LocalUser reports local and connected Microsoft accounts, including their SID and principal source.^2^

Then inspect its creation and elevation history:

1. Open Event Viewer.
2. Select Windows Logs > Security > Filter Current Log.
3. In Event IDs, enter: 4720,4732,4725,4738
4. Check:
   • 4720: account created
   • 4732: member added to a local security group
   • 4725: account disabled
   • 4738: account changed
5. In each event, record Subject, Target Account, Member, and timestamp. These events are specifically used to audit account creation, modification, disabling, and local-group membership changes.^3^

If no older events exist, the Security log may have rolled over or account-management auditing might not have been enabled; absence of an event does not establish who created the account.

2. Scan independently while Defender is unavailable

Download and run the 64-bit Microsoft Safety Scanner, choose Full scan, and review %SYSTEMROOT%\debug\msert.log. It is a portable on-demand scanner, expires 10 days after download, and does not replace real-time antivirus.^4^

Do not change important account passwords on this laptop until a malware scan completes. If a Microsoft account may be compromised, change its password afterward from a known-clean device.^5^

3. Check for residual McAfee registration

Because McAfee was already uninstalled, do not reinstall it. Check whether components remain:

1. Settings > Apps > Installed apps: look for McAfee entries.
2. Windows Security > Virus & threat protection > Manage providers: identify the registered antivirus provider.
3. Open services.msc and Task Manager and look for McAfee services/processes.^6^

If McAfee or another antivirus is still registered, use that vendor’s official cleanup utility and restart. Windows 11 automatically disables Defender while a non-Microsoft antivirus is active.^7^

4. Repair Defender when no other antivirus is active

In elevated PowerShell, check the services:

Get-Service WinDefend,WdBoot,WdFilter,WdNisSvc,WdNisDrv,
  SecurityHealthService,wscsvc |
  Format-Table -Auto DisplayName,Name,StartType,Status

Expected key states include WinDefend Automatic/Running, WdFilter Boot/Running, SecurityHealthService Manual/Running, and wscsvc Automatic/Running. WdBoot being stopped after boot is normal.^8^

Since DISM already succeeded, do not repeat it. In an elevated Command Prompt, run Microsoft’s documented platform-selection and reset sequence:

(set "_done=" & if exist "%ProgramData%\Microsoft\Windows Defender\Platform\" (for /f "delims=" %d in ('dir "%ProgramData%\Microsoft\Windows Defender\Platform" /ad /b /o:-n 2^>nul') do if not defined _done (cd /d "%ProgramData%\Microsoft\Windows Defender\Platform\%d" & set _done=1)) else (cd /d "%ProgramFiles%\Windows Defender")) >nul 2>&1
MpCmdRun.exe -RemoveDefinitions -All
MpCmdRun.exe -ResetPlatform
MpCmdRun.exe -SignatureUpdate -MMPC

Restart, then verify:

Get-MpComputerStatus |
  Select-Object AMRunningMode,AntivirusEnabled,
                RealTimeProtectionEnabled,AntivirusSignatureVersion

Record exact output if any command fails. Also install all updates under Settings > Windows Update; build 26200 has appeared in both Insider and later release families, so also check the device’s current Windows Insider/channel enrollment rather than diagnosing from the build number alone.^9^

5. Supported recovery fallback

If Defender or Windows Security remains broken, use Settings > System > Recovery > Fix problems using Windows Update > Reinstall now. This reinstalls the current Windows version, repairs system components, and preserves apps, files, and settings.^10^

Once Defender works, save open files and run Windows Security > Virus & threat protection > Scan options > Microsoft Defender Offline scan. It restarts the computer and scans outside the normal Windows environment.^11^

If malware is found or user123 cannot be explained, back up documents only and consider a clean Windows reinstall rather than trusting the existing installation.

References

1. Local accounts
2. Get-LocalUser-Description
3. Windows security baseline
4. Microsoft Safety Scanner Download
5. How to recover a hacked or compromised Microsoft account | Microsoft Support
6. apps on my windows 11 - Microsoft Q&A
7. Microsoft Defender Antivirus compatibility with other security products
8. Troubleshoot Microsoft Defender Antivirus service startup problems
9. Announcing Windows 11 Insider Preview Build 26200 (Canary Channel)
10. Fix issues by reinstalling the current version of Windows | Microsoft Support
11. Run and review the results of a Microsoft Defender Offline scan