Location of MpCmdRun.log

This logfile used to be located in Windows/Temp but that changed after some cumulative update to 1909. I'm using a third party AV but since Windows Defender's service still runs despite of that it used to create daily entries in that logfile, resulting in its growing over time. The file could be deleted safely since the service recreates it when it runs the next time.

Searching the whole C:/Windows folder yields no results even if hidden folders are shown. It's no longer present or does it go by a different name now?

You can just paste this straight into a shortcut or File explorer's address bar.

C:\Users\%UserName%\AppData\Local\Temp\MpCmdRun.log

I don't know if yours will have anything in it.
Mine has my record of MpCmdRun scripts [updates & scans] that I deliberately run using MpCmdRun's command line switches.
I don't think WD's automatic updates make use of MpCmdRun.

I have never cleaned my file out or deliberately replaced it. It is 2MB. Hardly even worth considering its size really.

Denis

What third party Av are you using?

I believe that C:\Windows\Temp\MpCmdRun.log is the log that ought, logically, to be maintained if another AV is in use. But the OP said he does not have one.

On 3 computers, C:\Windows\Temp\MpCmdRun.log varies between 1-3MB. So nothing worth taking any action about.

Denis

I have shortcuts to each log.

1 C:\Users\%UserName%\AppData\Local\Temp\MpCmdRun.log
This is straightforward.
I named this shortcut WD MpCmdRun log - user
Properties, Target field - C:\Users\%UserName%\AppData\Local\Temp\MpCmdRun.log

2 C:\Windows\Temp\MpCmdRun.log
This is awkward.
I named this shortcut WD MpCmdRun log - application [Admin]
Properties, Target field - cmd.exe /c "C:\Windows\Temp\MpCmdRun.log"
Properties, Comment field - Cmd window remains open while this file is open
Properties, Advanced - Run as Admin

Denis

FreeBooter said:

Please open the Command Prompt by typing cmd.exe into Start Menu, right-click on Cmd.exe, and open it as an administrator.
Execute below command to list locations of MpCmdRun.log file.

Code:

where /r C:\ MpCmdRun.log

Excellent suggestion. I suggest a slight variation to capture sizes and modified dates-times as well

Code:

where /r C:\ MpCmdRun.log /t

These were my results

Code:

   2190042   02/10/2020      12:39:24  C:\Users\%UserName%\AppData\Local\Temp\MpCmdRun.log
      3364   19/11/2018      10:59:24  C:\Windows\Microsoft Antimalware\Tmp\MpCmdRun.log
     11036   18/12/2019      15:01:57  C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log
   1798874   02/10/2020      01:31:37  C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\MpCmdRun.log
   3625540   02/10/2020      12:39:24  C:\Windows\Temp\MpCmdRun.log

The two copies we have been discussing are the biggest ones and were the last ones to be written to. I don't suppose the same things are being written in any of them

Whilst they don't even add up to a size that is worth any effort to clean up manually, I'm a bit surprised that routine Disk cleanup [including system files & all checkboxes] has not removed those 2018, 2019 ones.

I made the shortcuts to the two we've been discussing but I have never used them for anything productive.

Denis