Windows 11: "Defender trouble" due to updates KB5022845 and KB5022913 (app startup hangs)

[German]Quick note for blog readers who are running Windows 11 22H2. It looks like Microsoft has changed something internally with the February 2022 update KB5022845 and the Moments 2 update KB5022913, which is currently available as a preview. Users who have deactivated Windows Defender and have not installed any other virus protection may run into the problem that applications start slower or even hang completely after the update installation. However, there is a workaround to fix this.

German blog reader HPM hcontacted me by email to share his observations (thanks for that). But first, a brief classification of the affected updates.

Updates KB5022845 and KB5022913

Both updates KB5022845 and KB5022845 were rolled out by Microsoft in February 2023. The cumulative update KB5022845 is the regular Patchday 14 February 2023 security update for Windows 11 22H2. I had reported on this patch in the blog post Patchday: Windows 11/Server 2022 Updates (February 14, 2023). No known issues were reported there by Microsoft.

The Moments 2 preview update KB5022913 was rolled out for Windows 11 22H2 as of February 28, 2023. I presented its new features within the blog post Windows 11 22H2: Moments 2 update KB5022913 brings many new features. The details of this update are listed in the blog post Windows 11 22H2: Preview Update KB5022913 (Feb. 28, 2023).

Microsoft then released the preview update KB5022905 for Windows 11 22H2 (see Windows 11 21H2 Preview Update KB5022905 (Feb. 21, 2023)), which was not tested below.

Reader reports app launch issues caused by Defender

German blog reader HPM has been taking a closer look at his Windows installations for years and has always posted deeper insights in comments within my German blog. HPM emailed some days ago to report a observation with both February 2023 updates KB5022845 and KB5022913 (thanks for that). The reader wrote:

Hello Günter,

I'll tell you about unknown side effects of this update, maybe all following updates are affected. It affected
reproducible all systems here.

After Windows updates ran here approx. since the last millennium all without problems, there was now unexpected trouble with these two.

He mentioned the two updates KB5022845 and KB5022913 from February 2023 for Windows 11 22H2 already addressed above.

Programs do not start

Regarding the problems, the reader reported the following with regard to the Feb. 14, 2023 security update KB5022845:

KB5022845 [GB: The installation] went as usual without problems and errors. Stupidly, however, after the reboot the system had become completely unusable:

• Some programs (not all) took about a minute for the first start after booting, before the update [GB: they] were usually always there immediately without delay.
• Sometimes a program did not appear at all, but you could see in the task manager that it was started. The behavior did not change even after restarts.

This is of course the nightmare of every Windows 11 user when the system no longer works as usual after an update.

Deactivated Defender as the root cause

Fortunately, HPM is able to get to the bottom of such problems a bit deeper – and he doesn't have a default system configuration either, but customizes it. Regarding his findings, he wrote me the following:

After some testing, the cause revealed itself: it was the Windows Opener [GB: aka disabled Defender] – or rather, its absence. Since I value secure, problem-free systems, there is no snake oil installed on any system here, Defender is also disabled.

HPM uses the following .reg file to disable the Defender integrated in Windows 11:

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender
"DisableAntiSpyware"=dword:00000001 
HKLM\SOFTWARE\Microsoft\Windows Defender
"DisableAntiSpyware"=dword:00000001 
"DisableAntiVirus"=dword:00000001
HKLM\SYSTEM\CurrentControlSet\Services\WinDefend 
"Start" = 4

Windows Security then says: "Antivirus is managed by their organization", which yes is the policy default. Now HPM's observation was the following:e:

First time with this update (build 1105 to 1265) the system had become unusable due to these settings after the error free update.

I then went back to 1105, skipped 1265 and installed 1344 directly, with the same result, system unusable.

The build 22621.1344 mentioned above is the Moments 2 Preview Update KB5022913. At this point the question remained: What is the reason for this behavior. HPM has made the following discovery.

Following a bad premonition, I then activated Defender as a test and immediately the system was back to normal. Deactivated Defender again, system remained normal. Since 1265 Windows becomes unusable at first, if the update is done without active snake oil.

If this behavior continues, there will be a nonsense procedure after every update: Offender on/ Offender off again to make the damaged system usable again. Since snake oil runs on all systems worldwide, this madness is apparently not known yet or I have found nothing about it.

With "snake oil" third party antivirus systems are meant. And Offender is a deactivated defender. Translated this means: Systems running Windows 11 22H2, on which Windows Defender has been disabled without a third-party virus scanner installed, run into the issues described above, according to HPM's observations. If Defender is briefly enabled and then disabled again, the system runs as usual and the application startup hangs do not occur. Strange observation. By March 14, 2023 (March Patchday) at the latest, we will know if the behavior remains this way. Finally, the question is: Has anyone of you observed a similar behavior.

Similar articles:
Patchday: Windows 11/Server 2022 Updates (February 14, 2023)
Windows 11 21H2 Preview Update KB5022905 (Feb. 21, 2023)

Windows 11 22H2: Moments 2 update KB5022913 brings many new features
Windows 11 22H2: Preview Update KB5022913 (Feb. 28, 2023)
Windows 11 22H2: Moments 2 update KB5022913 causes startup problems with third-party GUI tools