From 6b80cb98416939c080cb5c054b3b1f8ec3fb2ea0 Mon Sep 17 00:00:00 2001 From: "Andrea Bichsel (Aquent LLC)" Date: Fri, 7 Dec 2018 22:15:29 +0000 Subject: [PATCH 1/7] Added note that scans will quit if computer unplugged. --- .../scheduled-catch-up-scans-windows-defender-antivirus.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md index d62ac289fe..8e79e53fea 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md @@ -11,7 +11,7 @@ ms.pagetype: security ms.localizationpriority: medium author: andreabichsel ms.author: v-anbic -ms.date: 09/03/2018 +ms.date: 12/07/2018 --- # Configure scheduled quick or full Windows Defender Antivirus scans @@ -42,7 +42,6 @@ To configure the Group Policy settings described in this topic: 6. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration. Click **OK**, and repeat for any other settings. - Also see the [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-windows-defender-antivirus.md) and [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md) topics. ## Quick scan versus full scan and custom scan @@ -66,6 +65,8 @@ A custom scan allows you to specify the files and folders to scan, such as a USB Scheduled scans will run at the day and time you specify. You can use Group Policy, PowerShell, and WMI to configure scheduled scans. +>[!NOTE] +>If a computer is unplugged and running on battery during a scheduled scan, the scheduled scan will quit. **Use Group Policy to schedule scans:** From 6a81d3453671e8251e665e6715578fb0bd66d5e0 Mon Sep 17 00:00:00 2001 From: "Andrea Bichsel (Aquent LLC)" Date: Mon, 10 Dec 2018 18:02:08 +0000 Subject: [PATCH 2/7] Update scan behavior on battery. --- .../scheduled-catch-up-scans-windows-defender-antivirus.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md index 8e79e53fea..31e7d1cd32 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md @@ -11,7 +11,7 @@ ms.pagetype: security ms.localizationpriority: medium author: andreabichsel ms.author: v-anbic -ms.date: 12/07/2018 +ms.date: 12/10/2018 --- # Configure scheduled quick or full Windows Defender Antivirus scans @@ -66,7 +66,7 @@ A custom scan allows you to specify the files and folders to scan, such as a USB Scheduled scans will run at the day and time you specify. You can use Group Policy, PowerShell, and WMI to configure scheduled scans. >[!NOTE] ->If a computer is unplugged and running on battery during a scheduled scan, the scheduled scan will quit. +>If a computer is unplugged and running on battery during a scheduled scan, the scheduled scan will stop with event 1002, which states that the scan stopped before completion. Windows Defender Antivirus will run a scan at the next scheduled time. **Use Group Policy to schedule scans:** From 0a95e81217775be699f11083152f49df025c98b3 Mon Sep 17 00:00:00 2001 From: "Andrea Bichsel (Aquent LLC)" Date: Mon, 10 Dec 2018 18:21:13 +0000 Subject: [PATCH 3/7] Updated mpcmdrun options --- ...line-arguments-windows-defender-antivirus.md | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md index cad1984faf..bac7f3d0cc 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md @@ -11,7 +11,7 @@ ms.pagetype: security ms.localizationpriority: medium author: andreabichsel ms.author: v-anbic -ms.date: 09/03/2018 +ms.date: 12/10/2018 --- # Configure and manage Windows Defender Antivirus with the mpcmdrun.exe command-line tool @@ -48,6 +48,21 @@ Command | Description \-ValidateMapsConnection | Used to validate connection to the [cloud-delivered protection service](configure-network-connections-windows-defender-antivirus.md) \-SignatureUpdate [-UNC [-Path ]] | Checks for new definition updates +\-? **or** -h | Displays all available options​ for this tool​ +\-Scan [-ScanType #] [-File [-DisableRemediation] [-BootSectorScan]]​ [-Timeout ]​ [-Cancel]​ | Scans for malicious software​ +\-Trace [-Grouping #] [-Level #] | Starts diagnostic tracing​ +\-GetFiles | Collects support information​ +\-GetFilesDiagTrack | Same as Getfiles but outputs to​ temporary DiagTrack folder​ +\-RemoveDefinitions [-All] | Restores the installed​ signature definitions​ to a previous backup copy or to​ the original default set of​ signatures​ +\-RemoveDefinitions [-DynamicSignatures] | Removes only the dynamically​ downloaded signatures​ +\-SignatureUpdate [-UNC | -MMPC] | Checks for new definition updates​ +\-Restore [-ListAll | [[-Name ] [-All] | [-FilePath ]] [-Path ]] | Restores or list​s quarantined item(s)​ +\-AddDynamicSignature [-Path] | Loads a dynamic signature​ +\-ListAllDynamicSignatures | Lists the loaded dynamic signatures​ +\-RemoveDynamicSignature [-SignatureSetID] | Removes a dynamic signature​ +\-CheckExclusion -path | Checks whether path is excluded + + ## Related topics - [Reference topics for management and configuration tools](configuration-management-reference-windows-defender-antivirus.md) From 72977ad40ad72d4444b5e04600a2877659951dc8 Mon Sep 17 00:00:00 2001 From: "Andrea Bichsel (Aquent LLC)" Date: Mon, 10 Dec 2018 18:21:46 +0000 Subject: [PATCH 4/7] Removed old table. --- ...mmand-line-arguments-windows-defender-antivirus.md | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md index bac7f3d0cc..ac8026396a 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md @@ -37,17 +37,6 @@ MpCmdRun.exe [command] [-options] Command | Description :---|:--- -\- ? **or** -h | Displays all available options for the tool -\-Scan [-ScanType #] [-File [-DisableRemediation] [-BootSectorScan]][-Timeout ] | Scans for malicious software -\-Trace [-Grouping #] [-Level #]| Starts diagnostic tracing -\-GetFiles | Collects support information -\-RemoveDefinitions [-All] | Restores the installed signature definitions to a previous backup copy or to the original default set of signatures -\-AddDynamicSignature [-Path] | Loads a dynamic signature -\-ListAllDynamicSignature [-Path] | Lists the loaded dynamic signatures -\-RemoveDynamicSignature [-SignatureSetID] | Removes a dynamic signature -\-ValidateMapsConnection | Used to validate connection to the [cloud-delivered protection service](configure-network-connections-windows-defender-antivirus.md) -\-SignatureUpdate [-UNC [-Path ]] | Checks for new definition updates - \-? **or** -h | Displays all available options​ for this tool​ \-Scan [-ScanType #] [-File [-DisableRemediation] [-BootSectorScan]]​ [-Timeout ]​ [-Cancel]​ | Scans for malicious software​ \-Trace [-Grouping #] [-Level #] | Starts diagnostic tracing​ From 44c96722ef74287ae9681efdd708abd8ca144489 Mon Sep 17 00:00:00 2001 From: "Andrea Bichsel (Aquent LLC)" Date: Mon, 10 Dec 2018 18:51:12 +0000 Subject: [PATCH 5/7] Specified full scan. --- .../scheduled-catch-up-scans-windows-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md index 31e7d1cd32..d40f911f2e 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md @@ -66,7 +66,7 @@ A custom scan allows you to specify the files and folders to scan, such as a USB Scheduled scans will run at the day and time you specify. You can use Group Policy, PowerShell, and WMI to configure scheduled scans. >[!NOTE] ->If a computer is unplugged and running on battery during a scheduled scan, the scheduled scan will stop with event 1002, which states that the scan stopped before completion. Windows Defender Antivirus will run a scan at the next scheduled time. +>If a computer is unplugged and running on battery during a scheduled full scan, the scheduled scan will stop with event 1002, which states that the scan stopped before completion. Windows Defender Antivirus will run a full scan at the next scheduled time. **Use Group Policy to schedule scans:** From 63d2a411bd2695d9e3c78daf1e151a8cc75b352b Mon Sep 17 00:00:00 2001 From: "Andrea Bichsel (Aquent LLC)" Date: Mon, 10 Dec 2018 18:54:06 +0000 Subject: [PATCH 6/7] Minor fix --- .../command-line-arguments-windows-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md index ac8026396a..912f65ae29 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md @@ -49,7 +49,7 @@ Command | Description \-AddDynamicSignature [-Path] | Loads a dynamic signature​ \-ListAllDynamicSignatures | Lists the loaded dynamic signatures​ \-RemoveDynamicSignature [-SignatureSetID] | Removes a dynamic signature​ -\-CheckExclusion -path | Checks whether path is excluded +\-CheckExclusion -path | Checks whether a path is excluded ## Related topics From affda860f712765019b91018a13e92f562a68743 Mon Sep 17 00:00:00 2001 From: "Andrea Bichsel (Aquent LLC)" Date: Mon, 10 Dec 2018 18:59:44 +0000 Subject: [PATCH 7/7] Fixed table formatting --- .../command-line-arguments-windows-defender-antivirus.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md index 912f65ae29..eb9084b991 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md @@ -44,8 +44,8 @@ Command | Description \-GetFilesDiagTrack | Same as Getfiles but outputs to​ temporary DiagTrack folder​ \-RemoveDefinitions [-All] | Restores the installed​ signature definitions​ to a previous backup copy or to​ the original default set of​ signatures​ \-RemoveDefinitions [-DynamicSignatures] | Removes only the dynamically​ downloaded signatures​ -\-SignatureUpdate [-UNC | -MMPC] | Checks for new definition updates​ -\-Restore [-ListAll | [[-Name ] [-All] | [-FilePath ]] [-Path ]] | Restores or list​s quarantined item(s)​ +\-SignatureUpdate [-UNC \| -MMPC] | Checks for new definition updates​ +\-Restore [-ListAll \| [[-Name ] [-All] \| [-FilePath ]] [-Path ]] | Restores or list​s quarantined item(s)​ \-AddDynamicSignature [-Path] | Loads a dynamic signature​ \-ListAllDynamicSignatures | Lists the loaded dynamic signatures​ \-RemoveDynamicSignature [-SignatureSetID] | Removes a dynamic signature​