Skip to content

Commit 092e192

Browse files
Learn Build Service GitHub AppLearn Build Service GitHub App
authored andcommitted
Merging changes synced from https://github.com/MicrosoftDocs/defender-docs-pr (branch live)
2 parents eb0bdc2 + 9139a88 commit 092e192

File tree

1 file changed

+3
-5
lines changed

1 file changed

+3
-5
lines changed

defender-endpoint/troubleshoot-mdav-scan-issues.md

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -155,10 +155,10 @@ Identifying why a scan was canceled enables you to identify what needs to be rev
155155

156156
| Reason | Details |
157157
|--|--|
158-
| The device restarts | Details of device restarts can be reviewed using Event Viewer on the device. <br/>- Event Log: System <br/>- Event IDs: `6005`, `6006`, `6007`, and `6008` |
158+
| The device restarts | Details of device restarts can be reviewed using Event Viewer on the device. <br/>- Event Log: System <br/>- Event IDs: 6005, 6006, 6007, and 6008 |
159159
| The scan times out | Scheduled scans use `mpcmdrun`, but if someone uses `mpcmdrun` to run an on-demand scan, the timer still applies. Antivirus scans launched by the Windows Security app (Local) and the Microsoft Defender portal don't use `mpcmdrun`, and each method starts a scan directly by using `mpclient`. <br/>- Scans initiated in the Microsoft Defender portal or the Windows Security app (Quick or Full): No time limit<br/>- Scheduled Full Scans or `MpCmdRun -scan`: Seven day limit<br/>- Scheduled Quick Scans or `MpCmdRun -scan`: One day limit |
160-
| The device is running on battery | If a device is unplugged and running on battery during a scheduled full scan, the scheduled scan stops with event `1002`, which states that the scan stopped before completion. Microsoft Defender Antivirus runs a full scan at the next scheduled time. For more information, see [Schedule antivirus scans: Important points to keep in mind](/microsoft-365/security/defender-endpoint/schedule-antivirus-scans?#important-points-to-keep-in-mind).
161-
| Other power-related events | The following event IDs (from Kernel-Power) indicate changing of the power state of the device which could impact the scanning finishing in a timely manner: <br/>- `107`: The system has resumed from sleep.<br/>- `42`: The system is entering sleep. Sleep Reason: Hibernate from Sleep - Standby Battery Budget Exceeded<br/>- `507`: The system is exiting Modern Standby. Reason: Sleep, Hibernate, or Shutdown.<br/>- `506`: The system is entering Modern Standby. Reason: Lid.<br/>- `105`: Power source change. |
160+
| The device is running on battery | If a device is unplugged and running on battery during a scheduled full scan, the scheduled scan stops with event 1002, which states that the scan stopped before completion. Microsoft Defender Antivirus runs a full scan at the next scheduled time. For more information, see [Schedule antivirus scans: Important points to keep in mind](/microsoft-365/security/defender-endpoint/schedule-antivirus-scans?#important-points-to-keep-in-mind).
161+
| Other power-related events | The following event IDs (from Kernel-Power) indicate changing of the power state of the device which could impact the scanning finishing in a timely manner: <br/>- 107: The system has resumed from sleep.<br/>- 42: The system is entering sleep. Sleep Reason: Hibernate from Sleep - Standby Battery Budget Exceeded<br/>- 507: The system is exiting Modern Standby. Reason: Sleep, Hibernate, or Shutdown.<br/>- 506: The system is entering Modern Standby. Reason: Lid.<br/>- 105: Power source change. |
162162

163163
## Use performance analyzer on the device
164164

@@ -218,5 +218,3 @@ Get-WinEvent -LogName 'Microsoft-Windows-Windows Defender/Operational' | where i
218218

219219
- [Configure scheduled quick or full Microsoft Defender Antivirus scans](schedule-antivirus-scans.md)
220220
- [Exclusions overview](navigate-defender-endpoint-antivirus-exclusions.md)
221-
222-

0 commit comments

Comments
 (0)