Skip to content

Commit aec801b

Browse files
committed
Update microsoft-defender-antivirus-using-powershell.md
1 parent ce0c916 commit aec801b

File tree

1 file changed

+6
-10
lines changed

1 file changed

+6
-10
lines changed

defender-endpoint/microsoft-defender-antivirus-using-powershell.md

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -46,12 +46,9 @@ This article describes configuration options in Windows 10 or newer and Windows
4646

4747
This guide provides the [Microsoft Defender Antivirus cmdlets](/powershell/module/defender/?view=windowsserver2022-ps&preserve-view=true) that configure the features you should use to evaluate our protection.
4848

49-
To use these cmdlets:
49+
To use these cmdlets, open PowerShell as an administrator, run a command, and then press **Enter**.
5050

51-
1. Open an elevated instance of PowerShell (choose to Run as administrator).
52-
1. Enter the command listed in this guide and press **Enter**.
53-
54-
You can check the status of all settings before you begin, or during your evaluation, by using the [Get-MpPreference PowerShell cmdlet](/powershell/module/defender/get-mppreference?view=windowsserver2022-ps&preserve-view=true).
51+
You can check the status of all settings before you begin, or during your evaluation, by using the [Get-MpPreference PowerShell cmdlet](/powershell/module/defender/get-mppreference).
5552

5653
Microsoft Defender Antivirus indicates a detection through [standard Windows notifications](configure-notifications-microsoft-defender-antivirus.md). You can also [review detections in the Microsoft Defender Antivirus app](review-scan-results-microsoft-defender-antivirus.md).
5754

@@ -61,15 +58,15 @@ The Windows event log also records detection and engine events. [See the Microso
6158

6259
Standard definition updates can take hours to prepare and deliver; our cloud-delivered protection service can deliver this protection in seconds.
6360

64-
More details are available in [Use next-gen technologies in Microsoft Defender Antivirus through cloud-delivered protection](/windows/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus).
61+
For more information, see [Cloud protection and Microsoft Defender Antivirus](cloud-protection-microsoft-defender-antivirus.md).
6562

6663
| Description | PowerShell Command |
6764
|---|---|
6865
|Enable the Microsoft Defender Cloud for near-instant protection and increased protection|`Set-MpPreference -MAPSReporting Advanced`|
6966
|Automatically submit samples to increase group protection|`Set-MpPreference -SubmitSamplesConsent Always`|
7067
|Always Use the cloud to block new malware within seconds|`Set-MpPreference -DisableBlockAtFirstSeen 0`|
7168
|Scan all downloaded files and attachments|`Set-MpPreference -DisableIOAVProtection 0`|
72-
|Set cloud block level to 'High'|`Set-MpPreference -CloudBlockLevel High`|
69+
|Set cloud block level to High|`Set-MpPreference -CloudBlockLevel High`|
7370
|High Set cloud block time-out to 1 minute|`Set-MpPreference -CloudExtendedTimeout 50`|
7471

7572
## Always-on protection (real-time scanning)
@@ -81,7 +78,7 @@ For more information on these options, see [Configure behavioral, heuristic, and
8178
| Description | PowerShell Command |
8279
|---|---|
8380
|Constantly monitor files and processes for known malware modifications | `Set-MpPreference -DisableRealtimeMonitoring 0` |
84-
|Constantly monitor for known malware behaviorseven in 'clean' files and running programs | `Set-MpPreference -DisableBehaviorMonitoring 0` |
81+
|Constantly monitor for known malware behaviors, even in files that aren't considered to be a threat, and running programs | `Set-MpPreference -DisableBehaviorMonitoring 0` |
8582
|Scan scripts as soon as they're seen or run | `Set-MpPreference -DisableScriptScanning 0` |
8683
|Scan removable drives as soon as they're inserted or mounted | `Set-MpPreference -DisableRemovableDriveScanning 0` |
8784

@@ -134,7 +131,6 @@ For more information, see [How do I configure or manage tamper protection](/defe
134131

135132
It's important to check that the Cloud Protection network connectivity is working during your pen testing. Using Command Prompt as an administrator, run the following command:
136133

137-
138134
```
139135
cd "C:\Program Files\Windows Defender"
140136
MpCmdRun.exe -ValidateMapsConnection
@@ -150,7 +146,7 @@ For more information, see [Microsoft Defender Offline](microsoft-defender-offlin
150146

151147
| Description | PowerShell Command |
152148
|---|---|
153-
|Ensure notifications allow you to boot the device into a specialized malware removal environment|Set-MpPreference -UILockdown 0|
149+
|Ensure notifications allow you to boot the device into a specialized malware removal environment|`Set-MpPreference -UILockdown 0`|
154150

155151
## Resources
156152

0 commit comments

Comments
 (0)