Windows Security Health Crash after Windows 11 22H2 Upgrade

As written above when it crashes on user action, it will restart by itself, so you're always protected except in the gap when it crashes and restarts...

hexaae said:

As written above when it crashes on user action, it will restart by itself, so you're always protected except in the gap when it crashes and restarts...

Click to expand...

Ok thank you for the answer. I don't think i can take any chances with that though. Might just go back to win10 if it doesn't have these issues.

I thought I would share my experience with this issue, and while I haven't completely resolved it, I have determined how to reduce the crashes of the SecurityHealthService.exe when using the windows security app. First a little info on my hardware and the reason I want to start there, is because I have a theory that the issue is probably related to certain hardware configurations. So my motherboard is based on the Intel B560 chipset. I am using the i5-10400F processor in it. I have the firmware TPM turned on. My other UEFI settings a very close to default with a few exceptions: Intel virtualization is enabled, Secure Boot for windows is enabled, and XMP is enabled (memory is rock solid stable). I mention these details to be thorough but there is no use in trying different BIOS settings to correct the issue I have tried. In windows security app I have also enabled the other device security features my system supports: Core isolation-memory integrity. The LSA protection feature is automatically turned on as is credential guard. My windows 11 Pro build # is 22621.1555, Windows Feature Experience Pack 1000.22640.1000.0. Windows Security Application Version: 1000.25305.0.1000, Windows Security Service Version: 1.0.2302.21002-0, Antimalware Client Version: 4.18.2303.8, Engine Version: 1.1.20200.4, Antivirus?Antispyware Version: 1.387.1073.0.

It was after the 22H2 upgrade that I noticed the problem. But before I discovered the issue I had updated the TPM firmware with a version that I downloaded from MoKiChU back in September (it cannot be rolled back). I also updated all my boards drivers with the other MoKiChU driver packages available at that time. So since I discovered the problem I have been furiously troubleshooting this issue and have tried all kinds of permutations of system configuration:

- different driver versions, and procedures for removing and installing drivers.
- resetting the windows defender platform
- resetting the Security app
- reinstalling the Security app
- clean boots
- windows in-place repair installation
- Rebuilding performance couters
- Rebuilding the WMI respository with a custom script written by a microsoft tech
- Removing the Intel RST driver and use the Standard SATA AHCI driver
- Every windows maintenance and troubleshooting step I can determine is worth trying.
BTW I do not have any SATA devices installed, my hard drive is an NVMe Intel 660p SSD, the graphics card is nVidia RTX-3060 Ti, the motherboard model is Asus Prime B560M-A AC.

What I have learned is that my TPM/motherboard just does not get along perfectly with windows. Maybe something is actually defective, not sure. But one of the performance counters was borked right from the start with fresh windows 10 installation, and the WMI repository also has some kind of problem. Symptoms of these issues are WMIADAP.exe runs until 8 minutes system uptime instead of only until 4.5 minutes or so, there are random graphics related crashes like with taskmgr. Other minor performance anomalies that you only notice if you really pay attention. Through trial and error I have repaired the problems with the repository and perf counters and solved those issues. If I run windows in place upgrade repair the problems return and I have to again repair the repository and perf counters. The system runs like a dream now (except for rare crashes of the Security app).

This security app problem that appeared with 22H2 has really been tough to find a solution. But to minimize the issue I have to use chipset drivers issued by Asus from my mb support page. Newer MoKiChU driver packs perform worse with the Security app crash issue as do the windows update chipset driver version. The MEI driver installed by windows updates works well as long as I remove all traces of other MEI drivers with the driver store explorer tool. I think that is pretty much the whole story. If anyone has any questions or other tips, comments, etc. I will be happy to read them and answer if I can.

Editing to add that BIOS versions for my board make no difference, I tried them all. I am using the latest version currently.

they're dragging their feet a little on this one...

Just checked the start date on the Microsoft thread I'm tagged in.
September 9th... Oh dear.

wrogg said:

they're dragging their feet a little on this one...

Just checked the start date on the Microsoft thread I'm tagged in.
September 9th... Oh dear.

Click to expand...

Aren't you being a little cryptic? If a Microsoft representative has acknowledged the problem I would like to know exactly what they said. Unless you have you been sworn to secrecy.

there's still no answers. I'd share if there were, I too have had that task manager crash, that may have been fixed? But on reading your above post I clicked on my windows security icon and unknown unknown unknown showed, closed and opened again and it's fine green ticks.
Big red X in the event viewer, won't happen again now for a week or two.
I tried to troubleshoot it 7 months ago, but intermittent Microsoft bugs can drive you insane..
It's just frustrating they make you upgrade to TPM 2.0 and it doesn't even work properly ..

Hey wrogg, thank you for the clarification. The way I look at these issues, if the product or software company hasn't acknowledged it as their issue, and the tech journals are not reporting anything after this long, then its probably not their issue, or at least they have not been able to replicate it. And if all that follows then I do not expect a fix from them.

The part in my previous post about a crashing task manager, may or may not be related. What I was explaining is that I know my system has these issues after a fresh windows install, I have been able to repair them for the most part, and it might be related. One more bit of info about the broken performance counter that I have repaired: when it is broken it can be observed in performance monitor application, click the plus sign to add a counter to the chart and see that Ntfs bucketized performance counters are not all grouped together together correctly, one of them is just hanging out by itself (actually its like a duplicate one). I hope I am explaining that well enough. I would post an image but its repaired and don't have an image of it.

I hadn't seen it for months. KB5025239 is causing major Windows 11 issues for some users suggests it's been re-introduced?


Here’s a list of all problems in the latest update:

• SSD performance issues cause slower boot times.
• Windows Security app interface is broken, and it incorrectly reports that TPM 2.0 is not installed and the device is vulnerable because LSA protection is off when enabled.
• Unresponsive desktop icons or icons disappear and reappear after installing the update.
• Windows Update stuck or fails with unhelpful error messages.
• Issues with File Explorer, taskbar and Task Manager.
• BSODs in rare cases.

wrogg said:

I hadn't seen it for months. KB5025239 is causing major Windows 11 issues for some users suggests it's been re-introduced?


Here’s a list of all problems in the latest update:

• SSD performance issues cause slower boot times.
• Windows Security app interface is broken, and it incorrectly reports that TPM 2.0 is not installed and the device is vulnerable because LSA protection is off when enabled.
• Unresponsive desktop icons or icons disappear and reappear after installing the update.
• Windows Update stuck or fails with unhelpful error messages.
• Issues with File Explorer, taskbar and Task Manager.
• BSODs in rare cases.

Click to expand...

Thanks for that link. So based on a quick review, this is of course not confirmed by Microsoft. And what it means to me, is that these users do have a broken system and maybe it is similar or the same as some of the issues I have identified. I recommend people share more information about their hardware so we can identify what is common with these systems.

I will share another way to identify one of my windows install issues that another system may have. If you open the registry editor and go to the following registry key Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM

Find the Value called Autorecover MOFs. Double click on it, being careful not to change anything, just copy the list stored there and paste it into notepad, then close the registry editor not saving any changes. Now examine the list you pasted into notepad. At the bottom, do you find duplicate entries related to the MEI driver or other duplicates? It would have to be an exact duplicate to be relevant. My theory about the cause is that when the MEI driver was being installed by windows setup, it ran into a problem that caused a bunch of duplicate attempts to modify the WMI repository. This then caused some WMI corruption which results in graphics crashes and other anomalies. Its just a theory, but when I remove the duplicates from that registry value list and rebuild the repository it solves the graphics crash problem and other symptoms for me. But the perf counters also need to be rebuilt after reinstalling chipset/system drivers. I would not be surprised if these duplicate Autorecover MOFs values show up in other systems having problems. If anyone wants to use the repository rebuild script I use (it works flawlessly) let me know.

Jimbo93 said:

I will share another way to identify one of my windows install issues that another system may have. If you open the registry editor and go to the following registry key Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM

Find the Value called Autorecover MOFs. Double click on it, being careful not to change anything, just copy the list stored there and paste it into notepad, then close the registry editor not saving any changes. Now examine the list you pasted into notepad. At the bottom, do you find duplicate entries related to the MEI driver or other duplicates? It would have to be an exact duplicate to be relevant. My theory about the cause is that when the MEI driver was being installed by windows setup, it ran into a problem that caused a bunch of duplicate attempts to modify the WMI repository. This then caused some WMI corruption which results in graphics crashes and other anomalies. Its just a theory, but when I remove the duplicates from that registry value list and rebuild the repository it solves the graphics crash problem and other symptoms for me. But the perf counters also need to be rebuilt after reinstalling chipset/system drivers. I would not be surprised if these duplicate Autorecover MOFs values show up in other systems having problems. If anyone wants to use the repository rebuild script I use (it works flawlessly) let me know.

Click to expand...

Hi,

I would be interested in trying the repository rebuild script.

Thanks a lot.

drotha2 said:

Hi,

I would be interested in trying the repository rebuild script.

Thanks a lot.

Click to expand...

ok, check your conversations inbox.

Just saw this on NeoWin:

I got Update for Microsoft Defender Antivirus antimalware platform - KB5007651 (Version 1.0.2303.27001) early this morning EDT.
I've not tested yet to see if the crashes still happen.

EDIT: Still got crash in Windows Security health Service after re-start when opening the Security Dashboard, click Device Security
My memory is not as good as it used to be, but I see that the settings for LSA are not showing in the Dashboard. Are they supposed to ?
I did do Brinks registry 'hack' to force LSA 'on' some weeks ago.

After installing KB5007651 yesterday, LSA + Windows Defender crash problem persists by navigating also in the headings :

Name of the failed application SecurityHealthService.exe, version: 10.0.22621.1485, timestamp: 0x45a7fb3f
Name of the failed module: ntdll.dll, version: 10.0.22621.1485, timestamp: 0xb7f0154a
Exception code: 0xc0000374
Error offset: 0x000000000010be19
ID of the failed process: 0x0x14BC
Start time of the failed application: 0x0x1D972BCC192DC95
Path of the failed application: C:\Windows\system32\SecurityHealthService.exe
Path of the failing module: C:\Windows\SYSTEM32\ntdll.dll
Report ID: 8fce7538-d21b-4dd2-87a0-fdf7f640a8d9
Full name of the failed package:
Application ID related to the failed package:

Unresolved problem.

Is some human entity in Microsoft still working at Windows Defender code, or is it maintened by AI?

Same problem also with the last update KB5025305 :



Name of the failed application SecurityHealthService.exe, version: 10.0.22621.1635, timestamp: 0xc9cb2878
Failed module name: ntdll.dll, version: 10.0.22621.1485, timestamp: 0xb7f0154a
Exception code: 0xc0000374
Error offset: 0x000000000010be19
ID of the failed process: 0x0x18F4
Start time of the failed application: 0x0x1D9780FF938EFFE
Path of the failed application: C:\Windows\system32\SecurityHealthService.exe
Path of the failing module: C:\Windows\SYSTEM32\ntdll.dll
Report ID: 65145e6b-acde-4ab4-91ca-95ddf7ee2177
Full name of the failed package:
Application ID for the failed package.

Unresolved problem.

After KB5025305 update my windows security app started crashing almost everytime I opened it. Here are the steps I used to get it back under control. Reset of the antimalware platform:

1. Pause windows updates and disable your network adapter.
2. Open the windows security app and go to Virus and threat protection, manage settings. Turn off real time protection and all other options there.
3. Open a command prompt as administrator and cd to c:\program files\windows defender.
4. Remove all AV defintions with the command: Mpcmdrun -removedefinitions -all
5. Reset the antimalware platform with the command: Mpcmdrun -resetplatform
6. Reboot the system.
7. Re-enable your network adapter
8. Open a command prompt as administrator and cd to c:\program files\windows defender.
9. Update the AV signatures with the command: Mpcmdrun -signatureupdate
10. Open windows security and turn on all threat protection settings you previously had turned off.
11. Unpause windows updates.

@Jimbo93
Let us know if it doesn't crash again in the next few days: sometimes "it seems" to be working for a couple of days, then it starts crashing again just opening Defender (Security Center) or on a manual directory/file scan... I don't think is a corrupt config of any kind you can repair, but a real bug in the code with the internal stack...

Windplay87 said:

Same problem also with the last update KB5025305 :



Name of the failed application SecurityHealthService.exe, version: 10.0.22621.1635, timestamp: 0xc9cb2878
Failed module name: ntdll.dll, version: 10.0.22621.1485, timestamp: 0xb7f0154a
Exception code: 0xc0000374
Error offset: 0x000000000010be19
ID of the failed process: 0x0x18F4
Start time of the failed application: 0x0x1D9780FF938EFFE
Path of the failed application: C:\Windows\system32\SecurityHealthService.exe
Path of the failing module: C:\Windows\SYSTEM32\ntdll.dll
Report ID: 65145e6b-acde-4ab4-91ca-95ddf7ee2177
Full name of the failed package:
Application ID for the failed package.

Unresolved problem.

Click to expand...

The issue isn't with the Cumulative update, but with the Antimalware platform update KB5007651, which has been an ongoing problem since last summer! Disabling the TPM will most likely fix the crashes (it does for me).

Which is somewhat ironic as a TPM is a requirement for installing Windows 11

@hexaae, I cannot completely eliminate the crashes. But by finding the best chipset and MEI drivers for my board and resetting the AV platform, I can reduce the problem from crashing most of the time to only crashing about 10% of the time.

@BrianInEngland, Hi, this problem seems to be hardware related to me. Or do you think that every windows eleven system has the problem? I really don't want to turn the TPM off.