WinDefend Service: OpenService failed (5)
OccamsXor opened this issue · comments
Hi there,
I was trying to execute the StopDefender today and I realized it gets "Access Denied" (5) error when it tries to open WinDefend service. I think Microsoft updated something in Feb '22 because I was able to execute it in the same machine in January. I will write some more details if I can debug the issue. Here is the command output:
[+] TrustedInstaller already running
[+] TrustedInstaller Service Started!
[+] Current user is: x
[+] Winlogon process found!
[+] TrustedInstaller process found!
[+] WINLOGON OpenProcess() success!
[+] WINLOGON OpenProcessToken() success!
[+] WINLOGON ImpersonatedLoggedOnUser() success!
[+] WINLOGON Current user is: SYSTEM
[+] TRUSTEDINSTALLER OpenProcess() success!
[+] TRUSTEDINSTALLER OpenProcessToken() success!
[+] TRUSTEDINSTALLER ImpersonatedLoggedOnUser() success!
[+] Current user is: SYSTEM
[+] OpenSCManager success!
[-] OpenService failed (5)
[-] TRUSTEDINSTALLER StopDefenderService() Error: 5
Hi,
you are completely right, Microsoft patched Defender service (WinDefend) DACLs and removed TrustedIntaller service account entry, so additional research would be needed in order to stop it again programatically :)