You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/mac-schedule-scan.md
+33-31Lines changed: 33 additions & 31 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ ms.service: defender-endpoint
5
5
author: denisebmsft
6
6
ms.author: deniseb
7
7
manager: deniseb
8
-
ms.reviewer: yongrhee
8
+
ms.reviewer: yonghree
9
9
ms.localizationpriority: medium
10
10
ms.date: 10/23/2024
11
11
audience: ITPro
@@ -29,21 +29,21 @@ search.appverid: met150
29
29
30
30
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink)
31
31
32
-
## Schedule a scan *built-in to* Microsoft Defender for Endpoint on macOS
32
+
## Schedule a scan built into Microsoft Defender for Endpoint on macOS
33
33
34
34
While you can start a threat scan at any time with Microsoft Defender for Endpoint, your enterprise might benefit from scheduled or timed scans. For example, you can schedule a scan to run at the beginning of every workday or week.
35
35
36
-
There are three types of scheduled scans that are configurable: hourly, daily, and weekly scans. Hourly and daily scheduled scans are always run as quick scans, weekly scans can be configured to be either quick or full scans. It is possible to have all three types of scheduled scans at the same time. See the samples below.
36
+
There are three types of scheduled scans that are configurable: hourly, daily, and weekly scans. Hourly and daily scheduled scans are always run as quick scans, weekly scans can be configured to be either quick or full scans. It's possible to have all three types of scheduled scans at the same time. See the samples in this article.
37
37
38
38
**Prerequisites**:
39
39
40
40
- Platform Update version: [101.23122.0005](mac-whatsnew.md#jan-2024-build-101231220005---release-version-2012312250) or newer
41
41
42
-
## Schedule a scan with *Microsoft Defender for Endpoint on macOS*
42
+
## Schedule a scan with Microsoft Defender for Endpoint on macOS
43
43
44
44
You can create a scheduled scan for your macOS, which is built in to *Microsoft Defender for Endpoint on macOS*.
45
45
46
-
For more information on the _.plist_ file format used here, see [About Information Property List Files](https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/AboutInformationPropertyListFiles.html) at the official Apple developer website.
46
+
For more information on the `.plist` file format used here, see [About Information Property List Files](https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/AboutInformationPropertyListFiles.html) at the official Apple developer website.
47
47
48
48
The following sample shows the daily and/or weekly configuration for the scheduled scan on macOS.
49
49
@@ -52,28 +52,26 @@ The following sample shows the daily and/or weekly configuration for the schedul
52
52
53
53
| Parameter | The acceptable values for this parameter are: |
54
54
| --- | --- |
55
-
| scheduledScan | enabled or disabled |
56
-
| scanType | quick or full |
57
-
| ignoreExclusions | true or false |
58
-
| lowPriorityScheduledScan | true or false |
59
-
| dayOfWeek | The range is between 0 and 8. <br>- 0: Everyday <br>- 1: Sunday <br>- 2: Monday <br>- 3: Tuesday <br>- 4: Wednesday <br>- 5: Thursday <br>- 6: Friday <br>- 7: Saturday <br>- 8: Never |
60
-
| timeOfDay | Specifies the time of day, as the number of _minutes after midnight_, to perform a scheduled scan. The time refers to the local time on the computer. If you don't specify a value for this parameter, a scheduled scan runs at a default time of two hours after midnight. |
61
-
| interval |0 (never), every 1 (hour) to 24 (hours, 1 scan per day) |
62
-
| randomizeScanStartTime | Only applicable for daily quick scans or weekly quick/full scans. Randomize the start time of the scan by up to specified number of hours. <br> For example, if a scan is scheduled for 2 p.m and randomizeScanStartTime is set to 2, the scan commences at a random time between 2 p.m and 4 p.m. |
55
+
|`scheduledScan`|`enabled` or `disabled`|
56
+
|`scanType`|`quick` or `full`|
57
+
|`ignoreExclusions`|`true` or `false`|
58
+
| lowPriorityScheduledScan |`true` or `false`|
59
+
|`dayOfWeek`| The range is between `0` and `8`. <br>- `0`: Everyday <br>- `1`: Sunday <br>- `2`: Monday <br>- `3`: Tuesday <br>- `4`: Wednesday <br>- `5`: Thursday <br>- `6`: Friday <br>- `7`: Saturday <br>- `8`: Never |
60
+
|`timeOfDay`| Specifies the time of day, as the number of `minutes after midnight`, to perform a scheduled scan. The time refers to the local time on the computer. If you don't specify a value for this parameter, a scheduled scan runs at a default time of two hours after midnight. |
61
+
|`interval`|`0` (never), `every 1` (hour) to `every 24` (hours, one scan per day) |
62
+
|`randomizeScanStartTime`| Only applicable for daily quick scans or weekly quick/full scans. Randomize the start time of the scan by up to specified number of hours. <br> For example, if a scan is scheduled for 2 p.m and `randomizeScanStartTime` is set to 2, the scan commences at a random time between 2 p.m and 4 p.m. |
63
63
64
-
Your scheduled scan runs at the date, time, and frequency you defined in your _plist_.
64
+
Your scheduled scan runs at the date, time, and frequency you defined in your `plist`.
65
65
66
-
### Example 1: Schedule a daily quick scan and weekly full scan using a _plist_
66
+
### Example 1: Schedule a daily quick scan and weekly full scan using a plist
67
67
68
-
In the following example, the daily quick scan configuration is set to run at 885 minutes after midnight (2:45 p.m.).<br>
69
-
The weekly configuration is set to run a full scan on Wednesday at 880 minutes after midnight (2:40 p.m.).
70
-
And it's set to ignore exclusions and run a low priority scan.
68
+
In the following example, the daily quick scan configuration is set to run at 885 minutes after midnight (2:45 p.m.). The weekly configuration is set to run a full scan on Wednesday at 880 minutes after midnight (2:40 p.m.). And it's set to ignore exclusions and run a low-priority scan.
71
69
72
-
The following code shows the schema you need to use to schedule scans according to the requirements above.
70
+
The following code shows the schema you need to use to schedule scans according to the requirements mentioned earlier.
73
71
74
72
1. Open a text editor and use this example as a guide for your own scheduled scan file.
75
73
76
-
#### For Intune:
74
+
#### For Intune
77
75
78
76
```XML
79
77
<?xml version="1.0" encoding="UTF-8"?>
@@ -151,9 +149,10 @@ The following code shows the schema you need to use to schedule scans according
151
149
</plist>
152
150
```
153
151
154
-
2. Save the file as _com.microsoft.wdav.mobileconfig_.
152
+
2. Save the file as `com.microsoft.wdav.mobileconfig`.
153
+
154
+
#### For JamF and other 3rd-party MDMs
155
155
156
-
#### For JamF and other 3rd-party MDMs:
157
156
```XML
158
157
<?xml version="1.0" encoding="UTF-8"?>
159
158
<!DOCTYPEplist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -189,7 +188,8 @@ The following code shows the schema you need to use to schedule scans according
189
188
</plist>
190
189
```
191
190
192
-
2. Save the file as _com.microsoft.wdav.plist_.
191
+
2. Save the file as `com.microsoft.wdav.plist`.
192
+
193
193
3. Check that the scheduled scan is configured via a "Set Preference"
194
194
195
195
```
@@ -198,7 +198,7 @@ The following code shows the schema you need to use to schedule scans according
198
198
199
199
In the results, you should be able to see [managed].
200
200
201
-
### Example 2: Schedule an hourly quick scan, a daily quick scan, and weekly full scan using a _plist_
201
+
### Example 2: Schedule an hourly quick scan, a daily quick scan, and weekly full scan using a plist
202
202
203
203
In the following example, an hourly quick scan will run every 6 hours, a daily quick scan configuration is set to run at 885 minutes after midnight (2:45 p.m.), and a weekly full scan will run on Wednesdays at 880 minutes after midnight (2:40 p.m).
204
204
@@ -280,9 +280,11 @@ In the following example, an hourly quick scan will run every 6 hours, a daily q
280
280
</dict>
281
281
</plist>
282
282
```
283
-
2. Save the file as _com.microsoft.wdav.mobileconfig_.
284
283
285
-
#### For JamF and other 3rd-party MDMs:
284
+
2. Save the file as `com.microsoft.wdav.mobileconfig`.
285
+
286
+
#### For JamF and other 3rd-party MDMs
287
+
286
288
1. Open a text editor and use this example.
287
289
288
290
```XML
@@ -322,7 +324,7 @@ In the following example, an hourly quick scan will run every 6 hours, a daily q
322
324
</plist>
323
325
```
324
326
325
-
2. Save the file as _com.microsoft.wdav.plist_.
327
+
2. Save the file as `com.microsoft.wdav.plist`.
326
328
327
329
3. Check that the scheduled scan is configured via a "Set Preference"
328
330
@@ -338,29 +340,29 @@ To enable scheduled scan feature:
338
340
339
341
|Version|Command|
340
342
|---|---|
341
-
| Version 101.23122.\* or higher | `sudo mdatp config scheduled-scan settings feature --value enabled` |
343
+
| Version 101.23122.x or later | `sudo mdatp config scheduled-scan settings feature --value enabled` |
342
344
343
345
To schedule hourly quick scans:
344
346
345
347
|Version|Command|
346
348
|---|---|
347
-
| Version 101.23122.\* or higher | `sudo mdatp config scheduled-scan quick-scan hourly-interval --value \<arg\>` |
349
+
| Version 101.23122.x or later | `sudo mdatp config scheduled-scan quick-scan hourly-interval --value \<arg\>` |
348
350
349
351
:::image type="content" source="media/schedule-scans-mac/schedule-scan-pic1.png" alt-text="Screenshot of schedule hourly scan.":::
350
352
351
353
To schedule daily quick scans:
352
354
353
355
|Version|Command|
354
356
|---|---|
355
-
| Version 101.23122.\* or higher | `sudo mdatp config scheduled-scan quick-scan time-of-day --value \<arg\>` |
357
+
| Version 101.23122.x or later | `sudo mdatp config scheduled-scan quick-scan time-of-day --value \<arg\>` |
356
358
357
359
:::image type="content" source="media/schedule-scans-mac/schedule-scan-pic2.png" alt-text="Screenshot of schedule daily quick scan.":::
358
360
359
361
To schedule weekly scans:
360
362
361
363
|Version|Command|
362
364
|---|---|
363
-
| Version 101.23122.\* or higher | `sudo mdatp config scheduled-scan weekly-scan --day-of-week \<arg\> --time-of-day \<arg\>--scan-type \<arg\>` |
365
+
| Version 101.23122.x or later | `sudo mdatp config scheduled-scan weekly-scan --day-of-week \<arg\> --time-of-day \<arg\>--scan-type \<arg\>` |
364
366
365
367
:::image type="content" source="media/schedule-scans-mac/schedule-scan-pic3.png" alt-text="Screenshot of schedule weekly scan.":::
0 commit comments