You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
|`-CheckExclusion -path <path>`|Checks whether a path is excluded.|
70
-
|`-TDT [-on|-off|-default]`|Disable or Enable TDT feature or sets it to default. If no option is specified, it will retrieve the current status.|
70
+
|`-TDT [-on|-off|-default]`|Disable or Enable TDT feature or sets it to default. If no option is specified, it retrieves the current status.|
71
71
|`-OSCA`|Prints OS Copy Acceleration feature status.|
72
72
|`-DeviceControl -TestPolicyXml <FilePath> [-Rules | -Groups]`|Validate xml policy groups and rules.|
73
73
|`-TrustCheck -File <FilePath>`|Checks trust status of a file.|
74
74
|`-ValidateMapsConnection`|Verifies that your network can communicate with the Microsoft Defender Antivirus cloud service. This command will only work on Windows 10, version 1703 or higher.|
75
-
|`-ListCustomASR`|List the custom ASR rules present on this device.|
76
-
|`-DisplayECSConnection`|displays URLs that Defender Core service will use to establish connection to ECS.|
75
+
|`-ListCustomASR`|List the custom Azure Site Recovery rules present on this device.|
76
+
|`-DisplayECSConnection`|displays URLs that Defender Core service uses to establish connection to ECS.|
77
77
|`-HeapSnapshotConfig <-Enable|-Disable> [-Pid <ProcessID>]`|Enable or Disable heap snapshot (tracing) configuration for process.<p><ProcessID> values<p>**0** (Default) 'MsMpEng.exe', currently running on system.<p>**1** 'MpDefenderCoreService.exe', currently running on system.<p>**2** 'NisSrv.exe', currently running on system.|
78
78
|<p>3 'MpDlpService.exe', currently running on system.<p><other> Apply command to a running process ID.||
79
79
|`-ResetPlatform`| Reset platform binaries back to `%ProgramFiles%\Windows Defender`.|
80
80
|`-RevertPlatform`| Revert platform binaries back to the previously installed version of the Defender platform.|
81
81
82
82
> [!NOTE]
83
-
> For the "Scan" command, the following are the default timeout values for Quick or Full scans where the scan will stop at that time by default.
84
-
- Scheduled Full Scans or MpCmdRun -scan: 7 day limit
85
-
- Scheduled Quick Scans or MpCmdRun -scan: 1 day limit
83
+
> For the "Scan" command, the following are the default time out values for Quick or Full scans where the scan will stop at that time by default.
84
+
- Scheduled Full Scans or MpCmdRun -scan: Seven day limit
85
+
- Scheduled Quick Scans or MpCmdRun -scan: One day limit
86
86
87
87
88
88
## Common errors in running commands via mpcmdrun.exe
@@ -91,7 +91,7 @@ The following table lists common errors that can occur while using the MpCmdRun
91
91
92
92
|Error message|Possible reason|
93
93
|---|---|
94
-
|**ValidateMapsConnection failed (800106BA)** or **0x800106BA**|The Microsoft Defender Antivirus service is disabled. Enable the service and try again. If you need help re-enabling Microsoft Defender Antivirus, see [Reinstall/enable Microsoft Defender Antivirus on your endpoints](switch-to-mde-phase-2.md#step-1-reinstallenable-microsoft-defender-antivirus-on-your-endpoints).<p> Note that in Windows 10 1909 or older, and Windows Server 2019 or older, the service was formerly called *Windows Defender Antivirus*.|
94
+
|**ValidateMapsConnection failed (800106BA)** or **0x800106BA**|The Microsoft Defender Antivirus service is disabled. Enable the service and try again. If you need help re-enabling Microsoft Defender Antivirus, see [Reinstall/enable Microsoft Defender Antivirus on your endpoints](switch-to-mde-phase-2.md#step-1-reinstallenable-microsoft-defender-antivirus-on-your-endpoints).<p> In Windows 10 1909 or older, and Windows Server 2019 or older, the service was formerly called *Windows Defender Antivirus*.|
95
95
|**0x80070667**|You're running the `-ValidateMapsConnection` command from a computer that is Windows 10 version 1607 or older, or Windows Server 2016 or older. Run the command from a machine that is Windows 10 version 1703 or newer, or Windows Server 2019 or newer.|
96
96
|**MpCmdRun is not recognized as an internal or external command, operable program, or batch file.**|The tool must be run from either `%ProgramFiles%\Windows Defender` or `C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2012.4-0` (where `2012.4-0` might differ since platform updates are monthly except for March)|
97
97
|**ValidateMapsConnection failed to establish a connection to MAPS (hr=80070005 httpcode=450)**|The command was attempted using insufficient privileges. Use the command prompt (cmd.exe) as an administrator.|
@@ -106,7 +106,7 @@ The following table lists common errors that can occur while using the MpCmdRun
106
106
-[Performance analyzer for Microsoft Defender Antivirus](tune-performance-defender-antivirus.md)
107
107
-[Configure Microsoft Defender Antivirus features](configure-microsoft-defender-antivirus-features.md)
108
108
-[Configure and validate Microsoft Defender Antivirus network connections](configure-network-connections-microsoft-defender-antivirus.md)
109
-
-[Reference topics for management and configuration tools](configuration-management-reference-microsoft-defender-antivirus.md)
109
+
-[Reference articles for management and configuration tools](configuration-management-reference-microsoft-defender-antivirus.md)
110
110
-[Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md)
111
111
-[macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune](/mem/intune/protect/antivirus-microsoft-defender-settings-macos)
112
112
-[Microsoft Defender for Endpoint on Linux](microsoft-defender-endpoint-linux.md)
0 commit comments