Windows Defender Default Behavior

Thanks. I wonder if by scheduling a daily scan, does it still do the random scans as well. Not that it matters, just really curious about how they built this program.

OK, so original poster back here - I have been watching to see what happens and Defender says real time protection is on. But it says that the last scan was yesterday morning, which is about 36 hours ago. I thought from the answers here that Defender would scan at opportune times throughout the day. I see no evidence of this. So, again I ask, without actually scheduling scans myself, is Defender doing scans on the go? Where can I see a log or evidence this is occurring?

Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational:

Looked in there and saw only the event from 2 days ago. After reading hundreds of posts, it seems that this a quite common that the auto scan doesn't work. I think I will just go back to Mcafee or something else.

In Task Scheduler navigate to
Task Scheduler Library > Microsoft > Windows > Windows Defender
You should see the built in WD Scan task

In Task Scheduler, Enable All Tasks History

After All Tasks History is enabled, you can look at the History tab of any task to see a log
You may need to wait hours/day to see the WD scan log info you want

I enabled all tasks history like you said. In the top window, it DID show a scan yesterday that I was not aware of. In the other window under history, there is nothing. Are you saying that this history could take a while to populate?

reelme said:

OK, so original poster back here - I have been watching to see what happens and Defender says real time protection is on. But it says that the last scan was yesterday morning, which is about 36 hours ago. I thought from the answers here that Defender would scan at opportune times throughout the day...

Yes, but Defender's definition of an 'opportune time' is when NO other activity is taking place. The automatic Defender scan is set to abort on any activity - even a mouse click can count as 'activity'. For the reassurance of a regular daily scan, set a scheduled task in addition to the automatic one - either that or leave the system running but unused for a while.

reelme said:

I enabled all tasks history like you said. In the top window, it DID show a scan yesterday that I was not aware of. In the other window under history, there is nothing. Are you saying that this history could take a while to populate?

No, i just meant you might have to wait a while before the task auto runs again, as soon as it runs the info should be in the History tab

I don't know what the other window under history logs and shows.

I didn't like the way the WD built in scan worked so i got rid of that task, i can't really test it unless i get that task back

So David, in that top window where it showed a scan ran yesterday - that doesn't correlate with the "scan details" note at the bottom of the Defender App page. Does the note on the Defender page just pertain to a manual scan maybe???