Salt-Minion Service Fails to Start (Windows Defender False Positive)

Products

• SaltStack entitlement to VMware
• VMware SaltStack
• VMware Tanzu Platform Services - SALT
• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

 

• After a recent update or installation, the salt-minion may fail to function on Windows systems.
 
• The salt-minion service appears in a "Paused" or "Stopped" state in the Services Manager (services.msc).
 
• Running salt-minion or salt-call from the command line returns immediately to the prompt with no output or error message.
 
• Attempting to launch the bundled Salt relenv Python executable directly results in the same silent exit.
 
• Windows Defender (Windows Security) may show a "Threat quarantined" notification or an entry in Protection History targeting python3.10.dll.

Environment

• Salt-Minion
 
• Windows Operating Systems
 
• Windows Defender (Windows Security)

Cause

A recent Windows Security intelligence update incorrectly identified a component of the Salt installer (python3.10.dll) as a threat. While Microsoft has since corrected this false positive, machines that haven't pulled the latest definitions may still block the file.

Resolution

1. Force Update Security Intelligence: You must first force an update of the Windows Defender definitions.    
        
   • Command Line Method (Recommended): Open the Command Prompt as an Administrator.
        
   • Navigate to the Windows Defender directory using cd "C:\Program Files\Windows Defender".
        
   • Clear the cached definitions by running MpCmdRun.exe -removedefinitions -dynamicsignatures.
        
   • Trigger a fresh update by running MpCmdRun.exe -SignatureUpdate.
      
      
        
   • Manual Download Method: If the machine has restricted internet access, download and run the latest definition installer (mpam-fe.exe) from the Microsoft Security Intelligence page.
      
    
 
2. Uninstall Salt-Minion: Uninstall the existing Salt-Minion to prepare for a clean installation.
 
3. Reinstall Salt-Minion: Run the Salt installer again. This step restores the previously quarantined DLL and ensures all files (including python3.10.dll) are correctly placed and no longer blocked.

Verification: After reinstallation, verify the fix by running salt-call --version. If the command successfully returns the version string, the minion service can be started normally.