You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/troubleshoot-mdav-scan-issues.md
+3-5Lines changed: 3 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -155,10 +155,10 @@ Identifying why a scan was canceled enables you to identify what needs to be rev
155
155
156
156
| Reason | Details |
157
157
|--|--|
158
-
| The device restarts | Details of device restarts can be reviewed using Event Viewer on the device. <br/>- Event Log: System <br/>- Event IDs: `6005`, `6006`, `6007`, and `6008`|
158
+
| The device restarts | Details of device restarts can be reviewed using Event Viewer on the device. <br/>- Event Log: System <br/>- Event IDs: 6005, 6006, 6007, and 6008 |
159
159
| The scan times out | Scheduled scans use `mpcmdrun`, but if someone uses `mpcmdrun` to run an on-demand scan, the timer still applies. Antivirus scans launched by the Windows Security app (Local) and the Microsoft Defender portal don't use `mpcmdrun`, and each method starts a scan directly by using `mpclient`. <br/>- Scans initiated in the Microsoft Defender portal or the Windows Security app (Quick or Full): No time limit<br/>- Scheduled Full Scans or `MpCmdRun -scan`: Seven day limit<br/>- Scheduled Quick Scans or `MpCmdRun -scan`: One day limit |
160
-
| The device is running on battery | If a device is unplugged and running on battery during a scheduled full scan, the scheduled scan stops with event `1002`, which states that the scan stopped before completion. Microsoft Defender Antivirus runs a full scan at the next scheduled time. For more information, see [Schedule antivirus scans: Important points to keep in mind](/microsoft-365/security/defender-endpoint/schedule-antivirus-scans?#important-points-to-keep-in-mind).
161
-
| Other power-related events | The following event IDs (from Kernel-Power) indicate changing of the power state of the device which could impact the scanning finishing in a timely manner: <br/>- `107`: The system has resumed from sleep.<br/>- `42`: The system is entering sleep. Sleep Reason: Hibernate from Sleep - Standby Battery Budget Exceeded<br/>- `507`: The system is exiting Modern Standby. Reason: Sleep, Hibernate, or Shutdown.<br/>- `506`: The system is entering Modern Standby. Reason: Lid.<br/>- `105`: Power source change. |
160
+
| The device is running on battery | If a device is unplugged and running on battery during a scheduled full scan, the scheduled scan stops with event 1002, which states that the scan stopped before completion. Microsoft Defender Antivirus runs a full scan at the next scheduled time. For more information, see [Schedule antivirus scans: Important points to keep in mind](/microsoft-365/security/defender-endpoint/schedule-antivirus-scans?#important-points-to-keep-in-mind).
161
+
| Other power-related events | The following event IDs (from Kernel-Power) indicate changing of the power state of the device which could impact the scanning finishing in a timely manner: <br/>- 107: The system has resumed from sleep.<br/>- 42: The system is entering sleep. Sleep Reason: Hibernate from Sleep - Standby Battery Budget Exceeded<br/>- 507: The system is exiting Modern Standby. Reason: Sleep, Hibernate, or Shutdown.<br/>- 506: The system is entering Modern Standby. Reason: Lid.<br/>- 105: Power source change. |
162
162
163
163
## Use performance analyzer on the device
164
164
@@ -218,5 +218,3 @@ Get-WinEvent -LogName 'Microsoft-Windows-Windows Defender/Operational' | where i
218
218
219
219
-[Configure scheduled quick or full Microsoft Defender Antivirus scans](schedule-antivirus-scans.md)
0 commit comments