You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/collect-diagnostic-data.md
+18-18Lines changed: 18 additions & 18 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ ms.localizationpriority: medium
6
6
author: emmwalshh
7
7
ms.author: ewalsh
8
8
ms.custom: nextgen
9
-
ms.date: 04/04/2025
9
+
ms.date: 06/06/2025
10
10
ms.reviewer: pahuijbr, yongrhee
11
11
manager: deniseb
12
12
ms.subservice: ngp
@@ -26,13 +26,9 @@ search.appverid: met150
26
26
**Applies to:**
27
27
28
28
-[Microsoft Defender for Endpoint Plan 2](microsoft-defender-endpoint.md)
29
-
30
29
-[Microsoft Defender for Business](https://www.microsoft.com/security/business/endpoint-security/microsoft-defender-business)
31
-
32
30
-[Microsoft Defender for Endpoint Plan 1](microsoft-defender-endpoint.md)
33
-
34
31
- Microsoft Defender Antivirus
35
-
36
32
-[Microsoft Defender for Individuals](https://www.microsoft.com/microsoft-365/microsoft-defender-for-individuals)
37
33
38
34
This article describes how to collect diagnostic data that's used by Microsoft support and engineering teams when they help troubleshoot issues with Microsoft Defender Antivirus.
@@ -48,23 +44,26 @@ On at least two devices that are experiencing the same issue, obtain the `.cab`
48
44
49
45
1. Open Command Prompt as an administrator by following these steps:
50
46
51
-
a. Open the **Start** menu.
52
-
53
-
b. Type **cmd**. Right-click on **Command Prompt** and then select **Run as administrator**.
54
-
55
-
c. Specify administrator credentials or approve the prompt.
56
-
47
+
a. Open the **Start** menu.
48
+
49
+
b. Type **cmd**. Right-click on **Command Prompt** and then select **Run as administrator**.
50
+
51
+
c. Specify administrator credentials or approve the prompt.
52
+
57
53
1. Navigate to the directory for Microsoft Defender Antivirus:
Where `<version>` is the actual version that starts with `4.18.2xxxx.x`
62
58
59
+
> [!NOTE]
60
+
> `C:\ProgramData` is a hidden folder. If you don't have a folder that starts with `4.18.2xxxx.x` in `C:\ProgramData\Microsoft\Windows Defender\Platform\`, then you will need to go to `C:\Program Files\Windows Defender\`.
61
+
63
62
1. Type the following command, and then press **Enter**
64
63
65
-
```Dos
66
-
mpcmdrun.exe -GetFiles
67
-
```
64
+
```Dos
65
+
mpcmdrun.exe -GetFiles
66
+
```
68
67
69
68
4. A `.cab` file is generated that contains various diagnostic logs. The location of the file is specified in the output in the command prompt. By default, the location is `C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab`.
Copies the diagnostic data to the specified path. If the path isn't specified, the diagnostic data is copied to the location specified in the Support Log Location Configuration.
89
88
90
-
When the SupportLogLocation parameter is used, a folder structure like as follows will be created in the destination path:
89
+
When the `SupportLogLocation` parameter is used, a folder structure like as follows will be created in the destination path:
91
90
92
91
```Dos
93
92
<path>\<MMDD>\MpSupport-<hostname>-<HHMM>.cab
@@ -122,7 +121,8 @@ You can also specify where the diagnostic `.cab` file is created using a Group P
122
121
3. Inside the policy editor, select **Enabled**.
123
122
124
123
4. Specify the directory path where you want to copy the support log files in the **Options** field.
0 commit comments