Task Scheduler Errors For Non-existent Windows Defender

I am getting this critical event notification on the SBS Detailed
Network Report:

TaskScheduler 103 9/11/2009 1:44:59 AM 1
Event Details:
Task Scheduler failed to start instance
"{C6712A67-4A9C-4C85-A3DA-8043CED34207}" of "\Microsoft\Windows
Defender\MP Scheduled Scan" task for user "GLIDDEN\GSBS$" . Additional
Data: Error Value: 2147942403.

This SBS 2008 server was installed without Windows Defender. It is not
listed in Installed Programs and does not exist on the Start Menu, nor
is there a service for it.

I cannot find the error in the Windows Event logs either, so I don't
know where this information is coming from.

There is a similar error in the report as well:

TaskScheduler 203 9/11/2009 1:44:59 AM 1
Event Details:
Task Scheduler failed to launch action "c:\program files\windows
defender\MpCmdRun.exe" in instance
"{C6712A67-4A9C-4C85-A3DA-8043CED34207}" of task "\Microsoft\Windows
Defender\MP Scheduled Scan". Additional Data: Error Value: 2147942403.

Both of these have occurred exactly once. Should I just clear the logs?

Sounds like you have an old scheduled task for updating it (was it installed
at one time?). Check control panel/scheduled tasks and delete/disable the
task.

--
Allan Williams




Bill Glidden wrote:
> I am getting this critical event notification on the SBS Detailed
> Network Report:
>
> TaskScheduler 103 9/11/2009 1:44:59 AM 1
> Event Details:
> Task Scheduler failed to start instance
> "{C6712A67-4A9C-4C85-A3DA-8043CED34207}" of "\Microsoft\Windows
> Defender\MP Scheduled Scan" task for user "GLIDDEN\GSBS$" . Additional
> Data: Error Value: 2147942403.
>
> This SBS 2008 server was installed without Windows Defender. It is not
> listed in Installed Programs and does not exist on the Start Menu, nor
> is there a service for it.
>
> I cannot find the error in the Windows Event logs either, so I don't
> know where this information is coming from.
>
> There is a similar error in the report as well:
>
> TaskScheduler 203 9/11/2009 1:44:59 AM 1
> Event Details:
> Task Scheduler failed to launch action "c:\program files\windows
> defender\MpCmdRun.exe" in instance
> "{C6712A67-4A9C-4C85-A3DA-8043CED34207}" of task "\Microsoft\Windows
> Defender\MP Scheduled Scan". Additional Data: Error Value: 2147942403.
>
> Both of these have occurred exactly once. Should I just clear the
> logs?

Hi Bill,

Thanks for your post and Allan's input.

The " MpCmdRun.exe " program is a process belonging to Microsoft Windows Defender Antispyware. Windows Defender Command Line Utility (c) 2006 Microsoft
Corporation. Use this tool to automate and troubleshoot Windows Defender. For detailed information, you may open command prompt window(cmd command) and locate to
C:\Program Files, check if there is a folder named " Windows Defender " and if any, type "MpCmdRun.exe /?" to see detailed instructions.

However, if the Windows Defender is indeed not installed, I agree with Allan that it may be caused by certain previous legacy/corrupted scheduled task(s). Then please go
to Administrative Tools and check Task Scheduler "and delete/disable the task" as Allan pointed.

Hope this helps. Also, if you have any questions or concerns, please do not hesitate to let me know.


Best regards,
Robbin Meng(MSFT)
Microsoft Online Newsgroup Support

================================================== ================
Please post your SBS 2008 related questions to the SBS newsgroup on Connect website:
https://connect.microsoft.com/sbs08/...i/default.aspx

Please post your EBS related questions to the EBS newsgroup on Connect website:
https://connect.microsoft.com/ebs08/...i/default.aspx

If you want to use a newsreader other than a web forum to access these newsgroups,
please refer to the following blog to apply NNTP password and configure a newsreader:
http://msmvps.com/blogs/bradley/arch...ewsgroups.aspx
================================================== ================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
================================================== ================
This posting is provided "AS IS" with no warranties, and confers no rights.
================================================== ================

Robbin Meng [MSFT] wrote:
>
> Hi Bill,
>
> Thanks for your post and Allan's input.
>
> The " MpCmdRun.exe " program is a process belonging to Microsoft Windows Defender Antispyware. Windows Defender Command Line Utility (c) 2006 Microsoft
> Corporation. Use this tool to automate and troubleshoot Windows Defender. For detailed information, you may open command prompt window(cmd command) and locate to
> C:\Program Files, check if there is a folder named " Windows Defender " and if any, type "MpCmdRun.exe /?" to see detailed instructions.
>
> However, if the Windows Defender is indeed not installed, I agree with Allan that it may be caused by certain previous legacy/corrupted scheduled task(s). Then please go
> to Administrative Tools and check Task Scheduler "and delete/disable the task" as Allan pointed.
>
> Hope this helps. Also, if you have any questions or concerns, please do not hesitate to let me know.
>
>
> Best regards,
> Robbin Meng(MSFT)
> Microsoft Online Newsgroup Support
>
> ================================================== ================
> Please post your SBS 2008 related questions to the SBS newsgroup on Connect website:
> https://connect.microsoft.com/sbs08/...i/default.aspx
>
> Please post your EBS related questions to the EBS newsgroup on Connect website:
> https://connect.microsoft.com/ebs08/...i/default.aspx
>
> If you want to use a newsreader other than a web forum to access these newsgroups,
> please refer to the following blog to apply NNTP password and configure a newsreader:
> http://msmvps.com/blogs/bradley/arch...ewsgroups.aspx
> ================================================== ================
> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from your issue.
> ================================================== ================
> This posting is provided "AS IS" with no warranties, and confers no rights.
> ================================================== ================
>
>
>
Thanks Al and Robin. I forgot to mention that I had already had a look
in Task Manager and did not see a scheduled task for Defender. When I
changed the view to show hidden Tasks, there it was. Strange that it was
there at all since, AFAIK, Defender was never installed on this server.
Cheers, Bill

Hi Bill,

Thanks for your prompt reply. I suspect, maybe it was once installed silently with other software. Anyway, glad to know you've found the culprit. You are welcome.

Please do not hesitate to post in SBS newsgroup if you need any assistance in the future.

Have a nice day!


Best regards,
Robbin Meng(MSFT)
Microsoft Online Newsgroup Support

================================================== ================
Please post your SBS 2008 related questions to the SBS newsgroup on Connect website:
https://connect.microsoft.com/sbs08/...i/default.aspx

Please post your EBS related questions to the EBS newsgroup on Connect website:
https://connect.microsoft.com/ebs08/...i/default.aspx

If you want to use a newsreader other than a web forum to access these newsgroups,
please refer to the following blog to apply NNTP password and configure a newsreader:
http://msmvps.com/blogs/bradley/arch...ewsgroups.aspx
================================================== ================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
================================================== ================
This posting is provided "AS IS" with no warranties, and confers no rights.
================================================== ================