Microsoft Defender Antivirus Network Inspection System Driver (WdNisDrv) Service Defaults in Windows 10

Helps guard against intrusion attempts targeting known and newly discovered vulnerabilities in network protocols.

Default Settings

Startup type:

Windows 10 Home 1507	Automatic
Windows 10 Pro 1507	Automatic
Windows 10 Education 1507	Automatic
Windows 10 Enterprise 1507	Automatic
Windows 10 Home 1511	Manual
Windows 10 Pro 1511	Manual
Windows 10 Education 1511	Manual
Windows 10 Enterprise 1511	Manual
Windows 10 Home 1607	Manual
Windows 10 Pro 1607	Manual
Windows 10 Education 1607	Manual
Windows 10 Enterprise 1607	Manual
Windows 10 Home 1703	Manual
Windows 10 Pro 1703	Manual
Windows 10 Education 1703	Manual
Windows 10 Enterprise 1703	Manual
Windows 10 Home 1709	Manual
Windows 10 Pro 1709	Manual
Windows 10 Education 1709	Manual
Windows 10 Enterprise 1709	Manual
Windows 10 Home 1803	Manual
Windows 10 Pro 1803	Manual
Windows 10 Education 1803	Manual
Windows 10 Enterprise 1803	Manual
Windows 10 Home 1809	Manual
Windows 10 Pro 1809	Manual
Windows 10 Education 1809	Manual
Windows 10 Enterprise 1809	Manual
Windows 10 Home 1903	Manual
Windows 10 Pro 1903	Manual
Windows 10 Education 1903	Manual
Windows 10 Enterprise 1903	Manual
Windows 10 Home 2004	Manual
Windows 10 Pro 2004	Manual
Windows 10 Education 2004	Manual
Windows 10 Enterprise 2004	Manual
Windows 10 Home 20H2	Manual
Windows 10 Pro 20H2	Manual
Windows 10 Education 20H2	Manual
Windows 10 Enterprise 20H2	Manual
Windows 10 Home 21H1	Manual
Windows 10 Pro 21H1	Manual
Windows 10 Education 21H1	Manual
Windows 10 Enterprise 21H1	Manual
Windows 10 Home 21H2	Manual
Windows 10 Pro 21H2	Manual
Windows 10 Education 21H2	Manual
Windows 10 Enterprise 21H2	Manual
Windows 10 Home 22H2	Manual
Windows 10 Pro 22H2	Manual
Windows 10 Education 22H2	Manual
Windows 10 Enterprise 22H2	Manual

Display name:

Microsoft Defender Antivirus Network Inspection System Driver

Service name:

WdNisDrv

Service type:

kernel

Error control:

normal

Path:

%SystemRoot%\system32\Drivers\WdNisDrv.sys

Registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdNisDrv

Default Behavior

Microsoft Defender Antivirus Network Inspection System Driver is a kernel device driver. It is starting automatically when the operating system starts in all editions of Windows 10 1507. This service is starting only if the user, an application or another service starts it in all editions of Windows 10 1511, Windows 10 1607, Windows 10 1703, Windows 10 1709, Windows 10 1803, Windows 10 1809, Windows 10 1903, Windows 10 2004, Windows 10 20H2, Windows 10 21H1, Windows 10 21H2, Windows 10 22H2.

If Microsoft Defender Antivirus Network Inspection System Driver fails to start, the failure details are being recorded into Event Log. Then Windows 10 will start up and notify the user that the WdNisDrv service has failed to start due to the error.

Dependencies

Microsoft Defender Antivirus Network Inspection System Driver cannot be started under any conditions, if the following services are disabled, deleted or working improperly:

While Microsoft Defender Antivirus Network Inspection System Driver is stopped, disabled or working incorrectly, the Microsoft Defender Antivirus Network Inspection Service cannot be launched.

Restore Default Startup Configuration of Microsoft Defender Antivirus Network Inspection System Driver

Before you begin doing this, make sure that all the services on which Microsoft Defender Antivirus Network Inspection System Driver depends are configured by default and function properly. See the list of dependencies above.

1. Run the Command Prompt as an administrator.

2. Depending on the version of your operating system, copy the commands below, paste them into the command window and press ENTER.

For Windows 10 1507 Home, Windows 10 1507 Pro, Windows 10 1507 Education, Windows 10 1507 Enterprise:
sc config WdNisDrv start= auto
sc start WdNisDrv

For Windows 10 1511 Home, Windows 10 1511 Pro, Windows 10 1511 Education, Windows 10 1511 Enterprise, Windows 10 1607 Home, Windows 10 1607 Pro, Windows 10 1607 Education, Windows 10 1607 Enterprise, Windows 10 1703 Home, Windows 10 1703 Pro, Windows 10 1703 Education, Windows 10 1703 Enterprise, Windows 10 1709 Home, Windows 10 1709 Pro, Windows 10 1709 Education, Windows 10 1709 Enterprise, Windows 10 1803 Home, Windows 10 1803 Pro, Windows 10 1803 Education, Windows 10 1803 Enterprise, Windows 10 1809 Home, Windows 10 1809 Pro, Windows 10 1809 Education, Windows 10 1809 Enterprise, Windows 10 1903 Home, Windows 10 1903 Pro, Windows 10 1903 Education, Windows 10 1903 Enterprise, Windows 10 1909 Home, Windows 10 1909 Pro, Windows 10 1909 Education, Windows 10 1909 Enterprise, Windows 10 2004 Home, Windows 10 2004 Pro, Windows 10 2004 Education, Windows 10 2004 Enterprise, Windows 10 20H2 Home, Windows 10 20H2 Pro, Windows 10 20H2 Education, Windows 10 20H2 Enterprise, Windows 10 21H1 Home, Windows 10 21H1 Pro, Windows 10 21H1 Education, Windows 10 21H1 Enterprise, Windows 10 21H2 Home, Windows 10 21H2 Pro, Windows 10 21H2 Education, Windows 10 21H2 Enterprise, Windows 10 22H2 Home, Windows 10 22H2 Pro, Windows 10 22H2 Education, Windows 10 22H2 Enterprise:
sc config WdNisDrv start= demand

3. Close the command window and restart the computer.

The WdNisDrv service is using the WdNisDrv.sys file that is located in the C:\Windows\system32\Drivers directory. If the file is removed or corrupted, read this article to restore its original version from Windows 10 installation media.