Cumulative Update KB4480116 Windows 10 v1809 Build 17763.253 - Jan. 8 Win Update

Bree said:

Your specs say Pro, PsGate13 (and my test) was using Home. Maybe that makes a difference?

Maybe and that seems probably why. But just to confirm what I said before here is the result of WD offline after running the following in the run dialog box:

Code:

%windir%\System32\winevt\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx

IronZorg89 said:

Maybe and that seems probably why. But just to confirm what I said before here is the result of WD offline...

And this is what I see after failing to run WD offline in Home. Note that mine shows nothing for the 'Old value:'

Bree said:

And this is what I see after failing to run WD offline in Home. Note that mine shows nothing for the 'Old value:'

Understandably, since it didn't complete the whole process. To another point, I don't know why whenever I ran WD Offline in the past, it always give that same result and when I check the registry path in Registry for offlineScanRun, the value has not changed (always at 1), the way it is supposed to be. Very weird, to say the least...

IronZorg89 said:

...Very weird, to say the least...

Even weirder, I am now successfully running an offline scan on that same Home machine without having changed anything else.

My guess, to trigger an offline scan at the next boot the key HKLM\SOFTWARE\Microsoft\Windows Defender\Scan\OflineScanRun has to be set to 0x1. If never run before the key doesn't exist yet. Defender seems unable to create the key when selecting an offline scan, only modify an existing key. Note that my eventlog said the old value was a 'N/A' key.

However, it did create the key after the first attempt when it tried to set it to 0x0. Now the key exists I can run Defender Offline.

Bree said:

Even weirder, I am now successfully running an offline scan on that same Home machine without having changed anything else.

My guess, to trigger an offline scan at the next boot the key HKLM\SOFTWARE\Microsoft\Windows Defender\Scan\OflineScanRun has to be set to 0x1. If never run before the key doesn't exist yet. Defender seems unable to create the key when selecting an offline scan, only modify an existing key. Note that my eventlog said the old value was a 'N/A' key.

However, it did create the key after the first attempt when it tried to set it to 0x0. Now the key exists I can run Defender Offline.

Go figure. At least, now it is running fine, that's what counts the most. You are right about: "

If never run before the key doesn't exist yet", because my main machine doesn't show those keys at all. Remember the recent WD Offline scan in post #130 was run on my second machine. Anyhow, thanks a lot for this exchange. Cheers!