HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend
    DisplayName    REG_SZ    @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310
    ErrorControl    REG_DWORD    0x1
    ImagePath    REG_EXPAND_SZ    "%ProgramFiles%\Windows Defender\MsMpEng.exe"
    Start    REG_DWORD    0x2
    Type    REG_DWORD    0x10
    Description    REG_SZ    @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-240
    DependOnService    REG_MULTI_SZ    RpcSs
    ObjectName    REG_SZ    LocalSystem
    ServiceSidType    REG_DWORD    0x1
    RequiredPrivileges    REG_MULTI_SZ    SeLoadDriverPrivilege\0SeImpersonatePrivilege\0SeBackupPrivilege\0SeRestorePrivilege\0SeDebugPrivilege\0SeChangeNotifyPrivilege\0SeSecurityPrivilege\0SeShutdownPrivilege\0SeIncreaseQuotaPrivilege\0SeAssignPrimaryTokenPrivilege\0SeTcbPrivilege\0SeSystemEnvironmentPrivilege
    FailureActions    REG_BINARY    80510100000000000000000003000000140000000100000060EA00000100000060EA00000000000000000000
    LaunchProtected    REG_DWORD    0x3
    FeaturesCount    REG_DWORD    0x2c
    LastFeaturesQuery    REG_SZ    2018/02/02/19:36:39

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend\Roles
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend\Security