Skip to content

Commit 3d43d75

Browse files
authored
Merge pull request #1689 from MicrosoftDocs/deniseb-fix
deniseb fix
2 parents f4e7e5b + 50c7e21 commit 3d43d75

File tree

1 file changed

+33
-31
lines changed

1 file changed

+33
-31
lines changed

defender-endpoint/mac-schedule-scan.md

Lines changed: 33 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ ms.service: defender-endpoint
55
author: denisebmsft
66
ms.author: deniseb
77
manager: deniseb
8-
ms.reviewer: yongrhee
8+
ms.reviewer: yonghree
99
ms.localizationpriority: medium
1010
ms.date: 10/23/2024
1111
audience: ITPro
@@ -29,21 +29,21 @@ search.appverid: met150
2929

3030
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink)
3131
32-
## Schedule a scan *built-in to* Microsoft Defender for Endpoint on macOS
32+
## Schedule a scan built into Microsoft Defender for Endpoint on macOS
3333

3434
While you can start a threat scan at any time with Microsoft Defender for Endpoint, your enterprise might benefit from scheduled or timed scans. For example, you can schedule a scan to run at the beginning of every workday or week.
3535

36-
There are three types of scheduled scans that are configurable: hourly, daily, and weekly scans. Hourly and daily scheduled scans are always run as quick scans, weekly scans can be configured to be either quick or full scans. It is possible to have all three types of scheduled scans at the same time. See the samples below.
36+
There are three types of scheduled scans that are configurable: hourly, daily, and weekly scans. Hourly and daily scheduled scans are always run as quick scans, weekly scans can be configured to be either quick or full scans. It's possible to have all three types of scheduled scans at the same time. See the samples in this article.
3737

3838
**Prerequisites**:
3939

4040
- Platform Update version: [101.23122.0005](mac-whatsnew.md#jan-2024-build-101231220005---release-version-2012312250) or newer
4141

42-
## Schedule a scan with *Microsoft Defender for Endpoint on macOS*
42+
## Schedule a scan with Microsoft Defender for Endpoint on macOS
4343

4444
You can create a scheduled scan for your macOS, which is built in to *Microsoft Defender for Endpoint on macOS*.
4545

46-
For more information on the _.plist_ file format used here, see [About Information Property List Files](https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/AboutInformationPropertyListFiles.html) at the official Apple developer website.
46+
For more information on the `.plist` file format used here, see [About Information Property List Files](https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/AboutInformationPropertyListFiles.html) at the official Apple developer website.
4747

4848
The following sample shows the daily and/or weekly configuration for the scheduled scan on macOS.
4949

@@ -52,28 +52,26 @@ The following sample shows the daily and/or weekly configuration for the schedul
5252
5353
| Parameter | The acceptable values for this parameter are: |
5454
| --- | --- |
55-
| scheduledScan | enabled or disabled |
56-
| scanType | quick or full |
57-
| ignoreExclusions | true or false |
58-
| lowPriorityScheduledScan | true or false |
59-
| dayOfWeek | The range is between 0 and 8. <br>- 0: Everyday <br>- 1: Sunday <br>- 2: Monday <br>- 3: Tuesday <br>- 4: Wednesday <br>- 5: Thursday <br>- 6: Friday <br>- 7: Saturday <br>- 8: Never |
60-
| timeOfDay | Specifies the time of day, as the number of _minutes after midnight_, to perform a scheduled scan. The time refers to the local time on the computer. If you don't specify a value for this parameter, a scheduled scan runs at a default time of two hours after midnight. |
61-
| interval | 0 (never), every 1 (hour) to 24 (hours, 1 scan per day) |
62-
| randomizeScanStartTime | Only applicable for daily quick scans or weekly quick/full scans. Randomize the start time of the scan by up to specified number of hours. <br> For example, if a scan is scheduled for 2 p.m and randomizeScanStartTime is set to 2, the scan commences at a random time between 2 p.m and 4 p.m. |
55+
| `scheduledScan` | `enabled` or `disabled` |
56+
| `scanType` | `quick` or `full` |
57+
| `ignoreExclusions` | `true` or `false` |
58+
| lowPriorityScheduledScan | `true` or `false` |
59+
| `dayOfWeek` | The range is between `0` and `8`. <br>- `0`: Everyday <br>- `1`: Sunday <br>- `2`: Monday <br>- `3`: Tuesday <br>- `4`: Wednesday <br>- `5`: Thursday <br>- `6`: Friday <br>- `7`: Saturday <br>- `8`: Never |
60+
| `timeOfDay` | Specifies the time of day, as the number of `minutes after midnight`, to perform a scheduled scan. The time refers to the local time on the computer. If you don't specify a value for this parameter, a scheduled scan runs at a default time of two hours after midnight. |
61+
| `interval` | `0` (never), `every 1` (hour) to `every 24` (hours, one scan per day) |
62+
| `randomizeScanStartTime` | Only applicable for daily quick scans or weekly quick/full scans. Randomize the start time of the scan by up to specified number of hours. <br> For example, if a scan is scheduled for 2 p.m and `randomizeScanStartTime` is set to 2, the scan commences at a random time between 2 p.m and 4 p.m. |
6363

64-
Your scheduled scan runs at the date, time, and frequency you defined in your _plist_.
64+
Your scheduled scan runs at the date, time, and frequency you defined in your `plist`.
6565

66-
### Example 1: Schedule a daily quick scan and weekly full scan using a _plist_
66+
### Example 1: Schedule a daily quick scan and weekly full scan using a plist
6767

68-
In the following example, the daily quick scan configuration is set to run at 885 minutes after midnight (2:45 p.m.).<br>
69-
The weekly configuration is set to run a full scan on Wednesday at 880 minutes after midnight (2:40 p.m.).
70-
And it's set to ignore exclusions and run a low priority scan.
68+
In the following example, the daily quick scan configuration is set to run at 885 minutes after midnight (2:45 p.m.). The weekly configuration is set to run a full scan on Wednesday at 880 minutes after midnight (2:40 p.m.). And it's set to ignore exclusions and run a low-priority scan.
7169

72-
The following code shows the schema you need to use to schedule scans according to the requirements above.
70+
The following code shows the schema you need to use to schedule scans according to the requirements mentioned earlier.
7371

7472
1. Open a text editor and use this example as a guide for your own scheduled scan file.
7573

76-
#### For Intune:
74+
#### For Intune
7775

7876
``` XML
7977
<?xml version="1.0" encoding="UTF-8"?>
@@ -151,9 +149,10 @@ The following code shows the schema you need to use to schedule scans according
151149
</plist>
152150
```
153151

154-
2. Save the file as _com.microsoft.wdav.mobileconfig_.
152+
2. Save the file as `com.microsoft.wdav.mobileconfig`.
153+
154+
#### For JamF and other 3rd-party MDMs
155155

156-
#### For JamF and other 3rd-party MDMs:
157156
``` XML
158157
<?xml version="1.0" encoding="UTF-8"?>
159158
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -189,7 +188,8 @@ The following code shows the schema you need to use to schedule scans according
189188
</plist>
190189
```
191190

192-
2. Save the file as _com.microsoft.wdav.plist_.
191+
2. Save the file as `com.microsoft.wdav.plist`.
192+
193193
3. Check that the scheduled scan is configured via a "Set Preference"
194194

195195
```
@@ -198,7 +198,7 @@ The following code shows the schema you need to use to schedule scans according
198198
199199
In the results, you should be able to see [managed].
200200
201-
### Example 2: Schedule an hourly quick scan, a daily quick scan, and weekly full scan using a _plist_
201+
### Example 2: Schedule an hourly quick scan, a daily quick scan, and weekly full scan using a plist
202202
203203
In the following example, an hourly quick scan will run every 6 hours, a daily quick scan configuration is set to run at 885 minutes after midnight (2:45 p.m.), and a weekly full scan will run on Wednesdays at 880 minutes after midnight (2:40 p.m).
204204
@@ -280,9 +280,11 @@ In the following example, an hourly quick scan will run every 6 hours, a daily q
280280
</dict>
281281
</plist>
282282
```
283-
2. Save the file as _com.microsoft.wdav.mobileconfig_.
284283

285-
#### For JamF and other 3rd-party MDMs:
284+
2. Save the file as `com.microsoft.wdav.mobileconfig`.
285+
286+
#### For JamF and other 3rd-party MDMs
287+
286288
1. Open a text editor and use this example.
287289

288290
```XML
@@ -322,7 +324,7 @@ In the following example, an hourly quick scan will run every 6 hours, a daily q
322324
</plist>
323325
```
324326

325-
2. Save the file as _com.microsoft.wdav.plist_.
327+
2. Save the file as `com.microsoft.wdav.plist`.
326328

327329
3. Check that the scheduled scan is configured via a "Set Preference"
328330

@@ -338,29 +340,29 @@ To enable scheduled scan feature:
338340
339341
|Version|Command|
340342
|---|---|
341-
| Version 101.23122.\* or higher | `sudo mdatp config scheduled-scan settings feature --value enabled` |
343+
| Version 101.23122.x or later | `sudo mdatp config scheduled-scan settings feature --value enabled` |
342344
343345
To schedule hourly quick scans:
344346
345347
|Version|Command|
346348
|---|---|
347-
| Version 101.23122.\* or higher | `sudo mdatp config scheduled-scan quick-scan hourly-interval --value \<arg\>` |
349+
| Version 101.23122.x or later | `sudo mdatp config scheduled-scan quick-scan hourly-interval --value \<arg\>` |
348350
349351
:::image type="content" source="media/schedule-scans-mac/schedule-scan-pic1.png" alt-text="Screenshot of schedule hourly scan.":::
350352
351353
To schedule daily quick scans:
352354
353355
|Version|Command|
354356
|---|---|
355-
| Version 101.23122.\* or higher | `sudo mdatp config scheduled-scan quick-scan time-of-day --value \<arg\>` |
357+
| Version 101.23122.x or later | `sudo mdatp config scheduled-scan quick-scan time-of-day --value \<arg\>` |
356358
357359
:::image type="content" source="media/schedule-scans-mac/schedule-scan-pic2.png" alt-text="Screenshot of schedule daily quick scan.":::
358360
359361
To schedule weekly scans:
360362
361363
|Version|Command|
362364
|---|---|
363-
| Version 101.23122.\* or higher | `sudo mdatp config scheduled-scan weekly-scan --day-of-week \<arg\> --time-of-day \<arg\>--scan-type \<arg\>` |
365+
| Version 101.23122.x or later | `sudo mdatp config scheduled-scan weekly-scan --day-of-week \<arg\> --time-of-day \<arg\>--scan-type \<arg\>` |
364366
365367
:::image type="content" source="media/schedule-scans-mac/schedule-scan-pic3.png" alt-text="Screenshot of schedule weekly scan.":::
366368

0 commit comments

Comments
 (0)