Defender scheduled scan set up.

Oldhead · 02 Mar 2020

Moderators kindly move this post to relevant if required.
I may have screwed up,advice welcomed . Task Scheduler > Libraries> Windows > Windows Defender .
Objective to insert new task > Scan daily full scan @7.30am.Start date 03/03/2020
Double clicked Windows defender current task > triggers > inserted what i thought was relevant > apply. Done

My concern ? is that i now have Windows defender scan (last run) (0x2) Last screen shot. also yellow warning Flag.
Also last line in this window (windows verification ) not run Last screen shot.

Defender scheduled scan set up.-task-scheduler-defender-triggers-no2.jpg

Defender scheduled scan set up.-task-scheduler-no3.jpg

Defender scheduled scan set up.-task-scheduler-no4.jpg

Defender scheduled scan set up.-task-scheduler-history-no5.jpg

Farvatten · 03 Mar 2020

Changing any of these 4 tasks under Task Scheduler > Libraries> Windows > Windows Defender has been problematic for many, and for a while now. This return code (0x2) common even when the task hasn't been changed, finding the task both runs successfully (0x0), and other times not (0x2), and for some, always failing with (0x2).

Just Google 'Defender (0x2)'

Windows Defender Scheduled Scan returns result 0x2
Scheduled Defender Scan Does Not Run
More importantly, any changes you do make will get overwritten every month when Windows pushes a new Defender Platform ( currently 4.18.2001.10-0 ) and all 4 of these tasks will get refreshed so they have the latest platform directory for that MpCmdRun.exe seen here in your screen print.

Defender scheduled scan set up.-defen-derplatformdirectorytaskscheduler.jpg

And while some have had success with a custom task directly under 'Task Scheduler Library' using their Admin Username, you'd still need to edit this task every month to point to the newest Defender Platform folder where MpCmdRun.exe will then reside.

Try3 · 03 Mar 2020

If you drag the column dividers so that the column contents can be seen you'd be able to see what was going on. For example, that item highlighted in yellow might well just say that the computer was not on at the time.

I always ignore the task you been editing and just create one of my own instead. It does not get overwritten. I use the task to run a batch file that identifies the latest version [see Farvatten above] and then runs a WD scan using that latest version. This all a lot more involved than you might want to bother with at the moment.

Denis

Oldhead · 03 Mar 2020

Thanks Try3 & Farvatten,
Dont have the knowledge to run Batch file . Guess i just wait until new platform with refresh.
Heard it all before changing to win10 ,but really win 10 is not user friendly compared to win 7 imo.
All i want is a O/S , security and with a reasonable intuative interface ,so i can go about my business. Not become an IT expert to handle what i call simplistic proceedures ( IE run programmed scans )
No more support for 7 so forced to upgrade .

- - - Updated - - -

Farvatten does that mean that what ever current changes i have made to task Scheduler in relation to defender running a new task with current platform ID ,new update ID will totally refresh the task scheduler (nothing scheduled for defender)
Further does that mean that i am stuck with performing both quick/full scans as a manual operation after the defender update . Thanks

Try3 · 03 Mar 2020

WD manages its scans itself. You do not need to do anything. You never have to run a scan yourself.

If you do want to have a task that manages WD scans [not that you need to] then you can create one yourself and it will not get overwritten by updates.
The risk of being overwritten only existed with what you were trying to do before because you were altering a task created by Windows for its own use so Windows update would feel free to reset that item back to its pristine state if it was deemed necessary.

To put it another way - Exactly why did you want to alter that TS task anyway? What did you think you would achieve?
[Edited to reduce the chances of misinterpretation]
- What benefit to yourself where you after?
- Did you think that WD required you to alter that task in order to make sure that scans took place?
- Were you not aware that you could check that WD was scanning of its own accord by looking in its user interface?
[WD, Virus & thread protection - the sub-heading Current threats shows when the last scan was run - and by comparing the date-time to TS you might even see that WD ran the scan itself without any reference to Task scheduler, because this does happen.]

Denis

Farvatten · 03 Mar 2020

Oldhead said:

Farvatten does that mean that what ever current changes i have made to task Scheduler in relation to defender running a new task with current platform ID ,new update ID will totally refresh the task scheduler (nothing scheduled for defender)

Further does that mean that i am stuck with performing both quick/full scans as a manual operation after the defender update . Thanks

I'm pretty sure Try3 answered your first question, and untouched this Windows Defender Scheduled Scan task should run a Quick Scan daily at some time that Windows deems necessary. There are those however that have consistently found that it fails occasionally or repeatedly with the (0x2) return code, and have created that task themselves as a workaround.

It helps to know that the bulk of Windows 10 Defender Protections are now mostly Real-Time, some say making the scanning process not as critical as it once was.

Try3 said:

Exactly why did you want to alter that TS task anyway? What did you think you would achieve?

I think Oldhead wanted some control over when this task ran, mentioning the change to a Full Scan at a specific time - 7:30am.

Try3 · 03 Mar 2020

OldHead,

I should also have mentioned - if it is the question of running full scans rather than quick scans that concerns you then look at
Quick scan versus full scan and custom scan - MSDocs
which explains that Quick scans are all you need unless you are cleaning up after a malware attack in which case a Full scan can help you check that even inactive components of the attack have been removed.

Denis

Oldhead · 03 Mar 2020

THanks again ,posters . I think i have my head around Defender now.?.
And yes i was under the impression that i had to set up a full scan as a regular occurence rather than just accept the pre programmed Defender quick or on demand full scan.
My bad .

wyxchari · 28 Mar 2020

Defender scheduled scan set up.-sin-titulo.jpg

Do not delete the (0x2) failed task. Add a new one with the desired programming. Program updates are detected to change the path of the mpcmdrun.exe file.

Program:

Code:

%windir%\system32\cmd.exe

Parameters:

Code:

/v:on /c (for /D %i IN ("%ProgramData%\Microsoft\Windows Defender\Platform\*.*") DO if "!sali!" LSS "%i" set sali=%i) & (start "Examen rapido de Windows Defender" /MIN "!sali!\mpcmdrun.exe" -Scan -ScanType 1)

- - - Updated - - -

https://docs.microsoft.com/en-us/win...nder-antivirus

Try3 · 28 Mar 2020

wyxchari -
The OP has already reported that he has no "desired programming". The OP does not need to do anything at all.
Your use of delayed exansion variables assumes that setlocal enabledelayedexpansion has already been declared.
The link you added at the end has already been provided in this thread but, because you have presented it with a different appearance, people will waste their time checking it out.
Denis