Not a problem since the 1st big update for 10 came out this afternoon, so had to fire it up anyway, plus in theory that meant this morning's tests might have been meaningless -- MS hasn't been posting release notes on these updates, so little idea yet what was allegedly fixed.
When you run Settings, select Update, & click Windows Defender, there are 3 switches -- Real-time protection, Cloud-based Protection, & Sample submission. With everything on or off, you have the service -- C:\Program Files\Windows Defender\MsMpEng.exe -- & the tray app -- C:\Program Files\Windows Defender\MSASCui.exe -- per Process Explorer.
When you go into Safe Mode w/Networking, just the service is running, which 10 wouldn't let me turn off. When you boot to the mode with Defender's service off, the Tray's running -- I can kill that process tree. There's a registry setting I found on-line that kills the service, & with that set I could get both the tray & the service shut down. [Edit: forgot to include this link in case someone else follows along -- it shows very clearly how to boot into the different modes. [http://www.cnet.com/how-to/how-to-boot-into-safe-mode-in-windows-10/]]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
"DisableAntiSpyware"=dword:00000001
Needless to say, none of that mattered a bit -- the wrapper runs, gets authorization, the actual setup fails with a very slight delay, & the wrapper message window appears, showing the key etc. Closing that window, the browser opens to GOTD as it's supposed to.
I assume that Defender probably has more going on than just that service & tray app, but blended in with the rest of the Windows code & processes. It may be that the only way to shut it off is to install a 3rd party AV app or suite, then turn that off?
I, against my better judgement, took a look at the Event Logs. During the 20-30 minutes I did the update & tried the different options, 180 errors, 38 warnings, & 491 info entries. Here's the one I found that might be relevant:
Log Name: Application
Source: Application Error
Date: 8/5/2015 3:11:41 PM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: WIN-21JEUT04FP0
Description:
Faulting application name: setup.exe_unknown, version: 0.0.0.0, time stamp: 0x4884f788
Faulting module name: KERNELBASE.dll, version: 10.0.10240.16384, time stamp: 0x559f3b2a
Exception code: 0xc00000fd
Fault offset: 0x000a552b
Faulting process id: 0xfe8
Faulting application start time: 0x01d0cfb28e2ec0d0
Faulting application path: C:\Users\M\AppData\Local\Temp\{32F0F8AC-E155-47A2-AA29-5DCDAF9A95FB}\setup.exe
Faulting module path: C:\WINDOWS\SYSTEM32\KERNELBASE.dll
Report Id: 722f6b20-5dc0-4501-92fd-6f878fed52ee
Faulting package full name:
Faulting package-relative application ID:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2015-08-05T19:11:41.000000000Z" />
<EventRecordID>436</EventRecordID>
<Channel>Application</Channel>
<Computer>WIN-21JEUT04FP0</Computer>
<Security />
</System>
<EventData>
<Data>setup.exe_unknown</Data>
<Data>0.0.0.0</Data>
<Data>4884f788</Data>
<Data>KERNELBASE.dll</Data>
<Data>10.0.10240.16384</Data>
<Data>559f3b2a</Data>
<Data>c00000fd</Data>
<Data>000a552b</Data>
<Data>fe8</Data>
<Data>01d0cfb28e2ec0d0</Data>
<Data>C:\Users\M\AppData\Local\Temp\{32F0F8AC-E155-47A2-AA29-5DCDAF9A95FB}\setup.exe</Data>
<Data>C:\WINDOWS\SYSTEM32\KERNELBASE.dll</Data>
<Data>722f6b20-5dc0-4501-92fd-6f878fed52ee</Data>
<Data>
</Data>
<Data>
</Data>
</EventData>
</Event>
