Tips: Windows Defender from the Command Line

This article will help you to handle better windows defender by command line utility.

Windows Defender includes a command-line utility, MpCmdRun.exe, which can be handy if you want to automate the use of Windows Defender. The utility is located on Windows at %ProgramFiles%\Windows Defender\MpCmdRun.exe.

The basic usage at the command prompt is: MpCmdRun.exe [command] [-options].

Command	Description
-?	Displays all available options for the tool
-Trace [-Grouping #] [-Level #]	Starts diagnostic tracing
-RemoveDefinitions [-All]	Restores the installed signature definitions to a previous backup copy or to the original default set of signatures
-RestoreDefaults	Resets the registry values for Windows Defender settings to known good defaults
-SignatureUpdate	Checks for new definition updates
-Scan [-ScanType]	Scans for malicious software
-GetFiles	Collects support information
Client Action	MpCmdRun Switches	Additional Switches
Scan for malicious software based on default configuration	-Scan -ScanType 0
Quick scan for malicious software	-Scan -ScanType 1
Full system scan for malicious software	-Scan -ScanType 2
File and directory custom scan for malicious software	-Scan -ScanType 3	-File -DisableRemediation -BootSectorScan -Timeout
Begins tracing Microsoft antimalware service’s actions	-Trace	-Grouping -Level
Gathers a bunch of files and packages them together in a compressed file in the support directory	-GetFiles	-Scan
Restores the last set of signature definitions	-RemoveDefinitions -All
Remove all Dynamic Signatures	-RemoveDefinitions -DynamicSignatures
Performs definition updates directly from UNC path file share specified	-SignatureUpdate -UNC	-Path
Performs definition updates directly from Microsoft Malware Protection Center	-SignatureUpdate -MMPC
List all quarantined items	-Restore -ListAll
Restores the most recently quarantined item based on threat name	-Restore -Name	-Path
Restores all the quarantined items	-Restore -All	-Path
Adds a Dynamic Signature	-AddDynamicSignature	-Path
Lists SignatureSet ID’s of all Dynamic Signatures	-ListAllDynamicSignatures
Removes a dynamic signature	-RemoveDynamicSignature -SignatureSetID
Enables integrity services	-EnableIntegrityServices
Submit all sample requests	-SubmitSamples

Use MpCmdRun alone to see additional information about the switches.

You will receive a return code if you use switch -Scan.

0 if no malware is found or successfully remediated
2 if malware is found and not remediated

Happy Learning!!!

Thanks & Regards,
Haresh Hirani
Email: [email protected]
Follow me: Twitter @hirravi1
linkedin: https://www.linkedin.com/in/hiraniconfigmgr

Author

Haresh Hirani

Hi, I Haresh Hirani, I am the person behind this webpage. Welcome to my page, Thank you for visiting the website and my page! My website is all about Microsoft technologies. More about ConfigMgr and all other technologies which are interesting for me. However, larger percentage of my posts are related to SCCM. Normally, like to post the interesting issues which I came across in my day to day tech life. you will find only solutions which comes on my day to day life.

Windows Defender from the Command Line

Tips: Windows Defender from the Command Line

This article will help you to handle better windows defender by command line utility.

Windows Defender includes a command-line utility, MpCmdRun.exe, which can be handy if you want to automate the use of Windows Defender. The utility is located on Windows at %ProgramFiles%\Windows Defender\MpCmdRun.exe.

The basic usage at the command prompt is: MpCmdRun.exe [command] [-options].

Command

Description

-?

Displays all available options for the tool

-Trace [-Grouping #] [-Level #]

Starts diagnostic tracing

-RemoveDefinitions [-All]

Restores the installed signature definitions to a previous backup copy or to the original default set of signatures

-RestoreDefaults

Resets the registry values for Windows Defender settings to known good defaults

-SignatureUpdate

Checks for new definition updates

-Scan [-ScanType]

Scans for malicious software

-GetFiles

Collects support information

Client Action

MpCmdRun Switches

Additional Switches

Scan for malicious software based on default configuration

-Scan -ScanType 0

Quick scan for malicious software

-Scan -ScanType 1

Full system scan for malicious software

-Scan -ScanType 2

File and directory custom scan for malicious software

-Scan -ScanType 3

-File -DisableRemediation -BootSectorScan -Timeout

Begins tracing Microsoft antimalware service’s actions

-Trace

-Grouping -Level

Gathers a bunch of files and packages them together in a compressed file in the support directory

-GetFiles

-Scan

Restores the last set of signature definitions

-RemoveDefinitions -All

Remove all Dynamic Signatures

-RemoveDefinitions -DynamicSignatures

Performs definition updates directly from UNC path file share specified

-SignatureUpdate -UNC

-Path

Performs definition updates directly from Microsoft Malware Protection Center

-SignatureUpdate -MMPC

List all quarantined items

-Restore -ListAll

Restores the most recently quarantined item based on threat name

-Restore -Name

-Path

Restores all the quarantined items

-Restore -All

-Path

Adds a Dynamic Signature

-AddDynamicSignature

-Path

Lists SignatureSet ID’s of all Dynamic Signatures

-ListAllDynamicSignatures

Removes a dynamic signature

-RemoveDynamicSignature -SignatureSetID

Enables integrity services

-EnableIntegrityServices

Submit all sample requests

-SubmitSamples

Use MpCmdRun alone to see additional information about the switches.

You will receive a return code if you use switch -Scan.

0 if no malware is found or successfully remediated

2 if malware is found and not remediated

Happy Learning!!!

Thanks & Regards,Haresh HiraniEmail: [email protected]Follow me: Twitter @hirravi1linkedin: https://www.linkedin.com/in/hiraniconfigmgr

Author

LEAVE A REPLY Cancel reply

Latest posts

Requirements for Windows AutoPilot

Boost Endpoint Security: Disable Regedit and CMD via Intune Settings Catalog

Windows Endpoint UI Hardening: Improve Productivity by Enforcing Distraction-Free Taskbars and Start Menus with Intune Settings Catalog.

Apple Mac Device Management through JAMF Setup Guide

Thanks & Regards,
Haresh Hirani
Email: [email protected]
Follow me: Twitter @hirravi1
linkedin: https://www.linkedin.com/in/hiraniconfigmgr