1

In Windows 10 Task Scheduler, under Task Scheduler Library > Microsoft > Windows > Windows Defender there is a Windows Defender Scheduled Scan Task. If you double-click on this Task, it brings up the Properties dialog, and under the Actions tab there is a single Action, Start a program. If you double-click on this Action, you will see that it runs the program

C:\Program Files\Windows Defender\MpCmdRun.exe

with the following arguments:

Scan -ScheduleJob -ScanTrigger 55.

But if you run CMD.exe, and use the cd command navigate to C:\Program Files\Windows Defender, and then enter the command MpCmdRun.exe, there do not appear to be any references to these arguments in the command line.

My understanding was that the Task Scheduler arguments were identical to ones you could use via Command Prompt. If so, is there something I missed looking over the available commands for MpCmdRun.exe in CMD.exe and, in that case, what does the original string of arguments indicate for Windows 10 Defender? Or, if not, is there a universal reference online somewhere for the differences between "command line" arguments vs. their "Task Scheduler" arguments belonging to certain programs?

I ran the task, and it has said Runnning for a few minutes now, but according to the tray icon for the Windows Defender Security Center there is no update, and for all I can tell Windows Defender does not appear to be doing anything.

If someone could please enlighten me as to the specifics of this particular command, as well as the details of differences (if any) between Task Scheduler and Command Prompt arguments, I would be much obliged.

  • what user is the task running under? most of the time scheduled tasks do not run in the same context as the users shell (desktop) so its not unsurprising that it doesn't interact with the tray instance. try opening Task manager and see if there is an active mpcmdrun process taking up CPU. – Frank Thomas Jun 6 '17 at 3:04
0

Please enlighten me as to the specifics of this particular command

You can run MpCmdRun from a cmd shell.

If you run it with a -? argument it will display all the possible command options.

MpCmdRun -?

Use the mpcmdrun.exe command-line tool to configure and manage Windows Defender Antivirus

Applies to:

Windows 10

Audience:

Enterprise security administrators

You can use a dedicated command-line tool to perform various functions in Windows Defender Antivirus.

This utility can be useful when you want to automate the use of Windows Defender Antivirus.

The utility is available in %ProgramFiles%\Windows Defender\MpCmdRun.exe and must be run from a command prompt.

Note

You may need to open an administrator-level version of the command prompt. Right-click the item in the Start menu, click Run as administrator and click Yes at the permissions prompt.

The utility has the following commands:

MpCmdRun.exe [command] [-options]

Command   Description
- ? or -h     Displays all available options for the tool
-Scan [-ScanType #] [-File [-DisableRemediation] [-BootSectorScan]][-Timeout ]    Scans for malicious software
-Trace [-Grouping #] [-Level #]   Starts diagnostic tracing
-GetFiles     Collects support information
-RemoveDefinitions [-All]     Restores the installed signature definitions to a previous backup copy or to the original default set of signatures
-AddDynamicSignature [-Path]  Loads a dynamic signature
-ListAllDynamicSignature [-Path]  Lists the loaded dynamic signatures
-RemoveDynamicSignature [-SignatureSetID]     Removes a dynamic signature
-ValidateMapsConnection   Used to validate connection to the cloud-delivered protection service
-SignatureUpdate [-UNC [-Path ]]  Checks for new definition updates

Source Use the mpcmdrun.exe command-line tool to configure and manage Windows Defender Antivirus


What about the other options -ScheduleJob -ScanTrigger 55?

The other options you mention -ScheduleJob -ScanTrigger 55 are not documented by Microsoft.

However, I did find the following question:

Will you please educate me and document the following three command line parameters for MpCmdRun.exe

  • ScheduleJob
  • WinTask
  • RestrictPrivilegesScan

The reply from a Microsoft MSVP was:

This command line option is for internal use. If you explain what you are trying to accomplish, I'm happy to help you achieve it with our documented interfaces.

Source ScheduleJob, WinTask, RestrictPrivilegesScan command line parameters

Not very helpful.

I also found this:

In the "Add arguments (optional)" field, type Scan -ScheduleJob or Scan-ScheduleJob -ScanType2`, and then click OK. The first option is for a quick scan and the second is for a full scan.

Again, not very helpful.

Source Scheduling scans

  • I mentioned in my question that I already looked up MpCmdRun.exe in CMD. Is there something specific about this code that relates to my question? – Stephen Hanson Jun 6 '17 at 22:12
  • @StephenHanson I've updated the answer with what limited information I can find (none of it from official Microsoft documentation). – DavidPostill Jun 6 '17 at 22:36

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.