The removal took one minute. The update failure arrives a month later, wearing a different error code, and most people never connect the two. This page connects them.
The pattern is so regular it deserves its own page: someone removes Microsoft Defender with a forced tool, everything seems fine, and then a cumulative update refuses to install. Retries fail. The error - often 0x800f081f, the 'source files could not be found' error - points at the component store, and the standard repair commands cannot fix it. This is not bad luck. It is the predictable consequence of deleting files that Windows servicing considers part of itself. Here is why it happens and the recovery ladder that actually works.
Modern Windows updates are not simple file copies. The component store (WinSxS) tracks every system component, its exact version and its dependencies, and updates are assembled against that inventory. Defender's engine, drivers, services and platform files are entries in that inventory - the same inventory that also delivers Defender's own monthly platform updates through Windows Update.
A remover script that deletes Defender folders, strips its services or neuters its tasks leaves the inventory describing parts that no longer exist on disk. The next cumulative update walks the inventory, reaches for a Defender file it must patch or stage, finds a hole, and fails - correctly, from its point of view.
The symptoms cluster. Cumulative updates fail repeatedly, sometimes rolling back after a restart. DISM /Online /Cleanup-Image /RestoreHealth ends with the source-files error because the component store it should repair from is itself missing the Defender payloads. sfc /scannow reports corruption it cannot repair. Windows Security shows blank or broken pages because its services were removed. And feature upgrades may fail - or succeed by quietly reinstalling Defender and undoing the removal, which is Microsoft's servicing model working as designed.
If your update problems began within a cycle or two of a forced Defender removal, treat that history as the prime suspect before trying random update fixes.
Notice what is not on the ladder: another remover, a registry cleaner, or deleting the update cache to force the same broken inventory to try again.
Do not pause updates indefinitely to hide the failure - the PC then misses security fixes for everything, not just Defender, and the inventory problem waits for you anyway. Do not run a second, different remover "to clean up properly"; each one edits the same services and policies in its own way and compounds the archaeology. And do not delete WinSxS content by hand under any circumstances - the component store is the one folder whose manual editing converts a repairable system into a reinstall.
Every step of that recovery exists because Defender was never an app sitting on top of Windows; it is a load-bearing part of the image. If you are reading this page before removing anything, let it settle the decision: on a machine you depend on, any change Windows servicing will treat as damage is a change whose real price is paid later, at update time, with interest. The supported routes in this guide set - another antivirus taking over, a temporary pause, an exclusion, a lab VM - exist precisely so this page never becomes your page.
The video shows removal in a minute; this page shows the month-later cost and the way back.
▶️ Watch Full VideoIt means the source files needed to complete an operation could not be found. In update failures after Defender removal, DISM or the update installer is looking for component files - including Defender payloads - that the removal deleted from the component store or the disk. Supplying a matching Windows ISO as the repair source, or doing an in-place repair install, is what resolves it.
Often it partially does, because a feature upgrade lays down a fresh Windows image - Defender included - which is also why removals rarely survive one. But relying on it means living with failing cumulative updates until it arrives, and the upgrade itself can fail against a damaged store. Repairing deliberately, on your schedule, is the better route.
Not reliably, and not in any supported way. Windows servicing assumes the Defender components exist; keeping them deleted means permanently fighting the mechanism that delivers your security updates for the whole OS. The sustainable states are Defender on, or Defender passive because another antivirus is registered - both fully serviced.