You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/schedule-antivirus-scans-powershell.md
+86-20Lines changed: 86 additions & 20 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ ms.localizationpriority: medium
6
6
author: emmwalshh
7
7
ms.author: ewalsh
8
8
ms.custom: nextgen
9
-
ms.date: 03/26/2025
9
+
ms.date: 04/17/2025
10
10
ms.reviewer: pauhijbr, ksarens
11
11
manager: deniseb
12
12
ms.subservice: ngp
@@ -32,32 +32,100 @@ search.appverid: met150
32
32
33
33
This article describes how to configure scheduled scans using PowerShell cmdlets. To learn more about scheduling scans and about scan types, see [Configure scheduled quick or full Microsoft Defender Antivirus scans](schedule-antivirus-scans.md).
34
34
35
-
## Use PowerShell cmdlets to schedule scans
35
+
## Use PowerShell cmdlets to set the general settings for Scheduled scan and/or On-Demand scan
36
+
37
+
| Description | Setting|PowerShell cmdlet|
38
+
| -------- | -------- | -------- |
39
+
|Check for Security Intelligence Updates Before Running Scan |Disabled/Not configured (Default)|Set-MpPreference -CheckForSignaturesBeforeRunningScan `Boolean` <br>For example: Set-MpPreference -CheckForSignaturesBeforeRunningScan $False|
40
+
|Randomize Schedule Task Times|Disabled/Not configured (Default)|Set-MpPreference -RandomizeScheduleTaskTimes `Boolean` <br>Example for physical devices: Set-MpPreference -RandomizeScheduleTaskTimes $False <br>Example for Virtual Machines (VMs) or Virtual Desktop Infrastructure (VDIs) or Azure Virtual Desktop (AVD): Set-MpPreference -RandomizeScheduleTaskTimes $True <br>Note: The default randomization time is within an interval of 30 minutes after the specified start time, if the "Scheduler Randomization Time" is also not configured.<br>Note 2: Applies to scheduled scans.|
41
+
|Scheduler Randomization Time|0/Not Configured (Default, Scheduled tasks aren't randomized)|Set-MpPreference -SchedulerRandomizationTime `UInt32` <br>For example: Set-MpPreference -SchedulerRandomizationTime 1<br>Note: If Randomize Schedule Task Times is "Not configured" and "Randomize Schedule Task Times" is also set to "Not configured," then the system will use the default behavior within an interval of 30 minutes after the specific start time.<br>Note: If you enable this setting, you must pick a randomization window in hours between 1 and 23. <br>Note 2: Applies to scheduled scans.|
42
+
|Avg CPU Load Factor|50/Not Configured (Default)|Set-MpPreference -ScanAvgCPULoadFactor `Byte`<br>For example: Set-MpPreference -ScanAvgCPULoadFactor 50 <br>Note: The default value is 50. The acceptable values are 5 through 100. <br>Note 2: The lower you set it, the longer the scan takes. <br>Note 3: If both ScanOnlyIfIdleEnabled and DisableCpuThrottleOnIdleScans are both enabled, then the value of ScanAvgCPULoadFactor is ignored. <br>Note 4: Applies to scheduled scans.|
43
+
|Start the scheduled scan only when device is on but not in use|True/Not Configured (Default)|Set-MpPreference -ScanOnlyIfIdleEnabled `Boolean`<br>For example: Set-MpPreference -ScanOnlyIfIdleEnabled $True <br>Note: Applies to scheduled scans.|
44
+
|Disable CPU throttle on idle scans|Enabled/Not Configured (Default)|Set-MpPreference -DisableCpuThrottleOnIdleScans `Boolean`<br>For example: Set-MpPreference -DisableCpuThrottleOnIdleScans $True <br>Idle here means 90% of CPU utilization or below|
|Enable full scan on battery power|Disabled/Not Configured (Default)|Set-MpPreference -EnableFullScanOnBatteryPower `Boolean`<br>For example: Set-MpPreference -EnableFullScanOnBatteryPower $False|
49
+
50
+
For more information, see [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](/editor/MicrosoftDocs/defender-docs-pr/defender-endpoint%2Fschedule-antivirus-scans-powershell.md/main/bcb7536e-34b9-8af7-5381-96c46d108a91/use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender Antivirus cmdlets](/powershell/module/defender/).
51
+
52
+
> [!NOTE]
53
+
> When you schedule scans for times when endpoints aren't in use, scans don't honor the CPU throttling configuration and will take full advantage of the resources available to complete the scan as fast as possible.
54
+
55
+
## Use PowerShell cmdlets for scheduling daily quick scans
36
56
37
57
Use the following cmdlets:
38
58
39
-
```PowerShell
40
-
Set-MpPreference -ScanParameters
41
-
Set-MpPreference -ScanScheduleDay
42
-
Set-MpPreference -ScanScheduleTime
43
-
Set-MpPreference -RandomizeScheduleTaskTimes
44
59
60
+
```powershell
61
+
Set-MpPreference -ScanScheduleQuickScanTime
45
62
```
46
63
47
-
For more information, see [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender Antivirus cmdlets](/powershell/module/defender/) for more information on how to use PowerShell with Microsoft Defender Antivirus.
64
+
> [!NOTE]
65
+
> The time value is represented as the number of minutes past midnights (00:00 or 12:00 a.m.), For example, 120 is equivalent to 2:00 AM. The schedule is based on local time on the device where the scan is executing.
48
66
49
-
## PowerShell cmdlets for scheduling scans when an endpoint isn't in use
67
+
For example, to set a daily quick scan run on the Windows clients at 12:00 PM. (720). In this example, we use lunch time, since many devices nowadays are turned off after-hours (For example, laptops and/or tablets).
68
+
69
+
70
+
```powershell
71
+
Set-MpPreference -ScanScheduleQuickScanTime 720
72
+
```
73
+
74
+
## Use PowerShell cmdlets to scheduling weekly quick or full scans
50
75
51
76
Use the following cmdlets:
52
77
53
78
```PowerShell
54
-
Set-MpPreference -ScanOnlyIfIdleEnabled
79
+
Set-MpPreference -ScanParameters
80
+
Set-MpPreference -ScanScheduleDay
81
+
Set-MpPreference -ScanScheduleTime
55
82
```
56
83
57
-
For more information, see [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender Antivirus cmdlets](/powershell/module/defender/).
84
+
-ScanParameters, specifies the scan type to use during a scheduled scan. The acceptable values for this parameter are:
58
85
59
-
> [!NOTE]
60
-
> When you schedule scans for times when endpoints aren't in use, scans don't honor the CPU throttling configuration and will take full advantage of the resources available to complete the scan as fast as possible.
86
+
1: Quick scan
87
+
88
+
2: Full scan
89
+
90
+
-ScanScheduleDay
91
+
92
+
Specifies the day of the week on which to perform a scheduled scan. Alternatively, specify everyday for a scheduled scan or never. The acceptable values for this parameter are:
93
+
94
+
0: Everyday
95
+
96
+
1: Sunday
97
+
98
+
2: Monday
99
+
100
+
3: Tuesday
101
+
102
+
4: Wednesday
103
+
104
+
5: Thursday
105
+
106
+
6: Friday
107
+
108
+
7: Saturday
109
+
110
+
8: Never
111
+
112
+
The default value is 8, never. If you specify a value of 8 or don't specify a value, Windows Defender doesn't perform scheduled scans.
113
+
114
+
-ScanScheduleTime
115
+
116
+
Specifies the time of day to run a scheduled scan. The time refers to the local time on the computer. Specify the number of minutes after midnight (for example, enter 60 for AM). This parameter has a default time of two hours after midnight (2 AM).
117
+
118
+
For example, setting the weekly scheduled scan for a quick scan, that runs every Wednesday at 12:00 PM (lunch time)
119
+
120
+
121
+
```powershell
122
+
Set-MpPreference -ScanParameters 1
123
+
Set-MpPreference -ScanScheduleDay 4
124
+
Set-MpPreference -ScanScheduleTime 720
125
+
```
126
+
127
+
> [!TIP]
128
+
> We recommend setting the scheduled scans for a quick scan with Real-Time Protection enabled, Cloud Protection enabled and having the network connectivity to the Cloud Protection backend.
61
129
62
130
## PowerShell cmdlets for scheduling scans to complete remediation
See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender Antivirus cmdlets](/powershell/module/defender/) for more information on how to use PowerShell with Microsoft Defender Antivirus.
139
+
#### See also
72
140
73
-
## PowerShell cmdlets for scheduling daily scans
141
+
[Troubleshoot Microsoft Defender Antivirus scan issues](/defender-endpoint/troubleshoot-mdav-scan-issues)
74
142
75
-
Use the following cmdlets:
143
+
[Use PowerShell cmdlets to configure and manage Microsoft Defender Antivirus](/defender-endpoint/use-powershell-cmdlets-microsoft-defender-antivirus)
76
144
77
-
```PowerShell
78
-
Set-MpPreference -ScanScheduleQuickScanTime
79
-
```
145
+
[Set the PowerShell cmdlet to configure and manage Microsoft Defender Antivirus](/powershell/module/defender/set-mppreference)
80
146
81
-
For more information about how to use PowerShell with Microsoft Defender Antivirus, see [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender Antivirus cmdlets](/powershell/module/defender/).
147
+
[Defender Antivirus specific PowerShell functions](/powershell/module/defender)
82
148
83
149
> [!TIP]
84
150
> If you're looking for Antivirus related information for other platforms, see:
0 commit comments