nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
- SolarWinds Academy
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

System Down due to Windows Defender update

JoanMhay.Malinab · 2026-09-01T05:48:05+00:00

Symptoms: * The SolarWinds web console returns Server Error in '/' Application or does not load. * SolarWinds services fail to start or repeatedly stop. * SAM jobs, orchestration, job scheduling, SWIS communication, or polling are impaired. * Defender history shows multiple SolarWinds files quarantined or remediated Cause:…

JoanMhay.Malinab

Symptoms:

The SolarWinds web console returns Server Error in '/' Application or does not load.
SolarWinds services fail to start or repeatedly stop.
SAM jobs, orchestration, job scheduling, SWIS communication, or polling are impaired.
Defender history shows multiple SolarWinds files quarantined or remediated

Cause:

So far, confirmed defender versions are:

1.457.394.0
1.457.399.0
1.457.401.0
1.457.407.0

Currently confirmed files affected:

\solarwinds\orion\seum\player\solarwinds.seum.agentdomainconfigurationtool.exe
\solarwinds\orion\solarwinds.ncm.strings.dll
\solarwinds\orion\web\apps\bin
ats.client.hosting.dll
\solarwinds\orion\solarwinds.diagnostics.contract.dll
\solarwinds\orion\solarwinds.credentials.oauth2.dll
\solarwinds\orion\web\api2\bin\solarwinds.orion.identity.models.dll
\solarwinds\orion\web\bin\solarwinds.orion.eoc.models.dll
\solarwinds\orion\solarwinds.orion.activediagnostics.contract.dll
internalbehavior: B254ED5DA269F3C6DC763DD6E50BDFC2

Resolution:

Steps to validate the defender version:

Open powershell
Run the command

Get-MpComputerStatus |Select AMProductVersion, AMEngineVersion, AntivirusSignatureVersion

The version release date can be validated from:

https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes ?

Workaround 1:

Add the SolarWinds folder to the Defender exclusion list.**
Restore any SolarWinds files quarantined by Microsoft Defender.
Run the SolarWinds Configuration Wizard
Verify that they start successfully.

Workaround 2. (If Dependecy is missing - RMQ, SWA and .Net Shared Network)

Add the SolarWinds folder to the Defender exclusion list.**
Restore any SolarWinds files quarantined by Microsoft Defender.
Do a repair in the control panel > Solarwinds
Run the Configuration Wizard after

**Steps to Add a Folder Exclusion

Click the Start menu or taskbar search box and type Windows Security.
Open the Windows Security app from the search results.
Select Virus & threat protection from the side menu or main dashboard.
Under Virus & threat protection settings, click Manage settings.
Scroll down to the Exclusions section and click Add or remove exclusions.
Click the + Add an exclusion button and select Folder from the drop-down menu.
Browse your computer, select the folder you want to ignore, and click Select Folder.

In some cases, disabling Windows Defender might not work.

If that's the case, please have it checked with the customer security team.

Some possible reasons:

A managed policy is overriding the local setting.
The detection is from another Defender capability.
The file was already quarantined or removed.
Another security product is still active.

Find more posts tagged with

SolarWinds Self-Hosted Platform

windows defender

system down

npm

Comments

vinay.by

Thank you @fop and @Kita for sharing the details.

I didnt encounter this as I already have excluded all SolarWinds folders in Defender.

fop

After an issue with Defender locking files ages ago I got this list from support for exclusions:

$path = @(
"C:\inetpub\Solarwinds",
"C:\Program Files (x86)\Common Files\Solarwinds",
"C:\Program Files (x86)\Microsoft SQL Server",
"C:\Program Files (x86)\SolarWinds",
"C:\Program Files\Common Files\Solarwinds",
"C:\Program Files\SolarWinds",
"C:\ProgramData\Application Data\SolarWinds",
"C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys*",
"C:\ProgramData\SolarWinds",
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Temporary ASP.NET Files",
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files",
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files",
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files"
)
Set-MpPreference -ExclusionPath $path
Set-MpPreference -ExclusionProcess SolarWinds.Administration.exe

Ironically, Defender still locks files and prevents them being deleted so YMMV.

Kita

The latest Windows Defender definition update, version 1.457.429.0, should resolve the issue. Once updated, the suggestion is to remove the exclusion (if already taken). In some cases, the configuration wizard may need to be ran to bring it back up and running.

vinay.by

Thanks for sharing this @JoanMhay.Malinab

rob.collins

Many thanks, we ran into this issue; did need workaround 2 once we'd cleared the defender threat alerts and restored the missing files from our server level backups (we did also need to manually recreate one of the WPA playback services via command prompt, as the repair operation did not fix this one as it did with the collector service). We were running 2026.1.1 for reference.

dgsmith80

I have a client experiencing this at the moment, and the issue is that they are unable to Restore the files even after applying the update from Microsoft and updating the policy.

ecklerwr1

Does defender seem to do this to any version of Observability or what version were you on?

Quick Links

Dynamic Interface Dashboard; HTML/JS
I wanted to share a new dashboard a co-worker ( @mblackburn ) came up with to help us better view groups of interfaces and various metrics for each. Using a single HTML widget, we are able to visually compare numerous different interfaces by populating each interface dataset onto its own graph. We are able to view…
PALO-ALG - Logging
PALO-ALG - Logging.xmlPalo Alto Networks ALG Security Technical Implementation Guide :: Version 2, Release: 3 Benchmark Date: 27 Oct 2022
Alert HTML Content
Alert Cleared.htmlHello, I would like to share the HTML template details we have prepared so that Solarwinds alarms can become more meaningful. It can list alarm object details and connected device details separately in HTML template. Except for object and device details, you can easily add custom property information…
Cisco ASR Devices
Cisco ASR Devices.pollerCisco ASR Devices