How to Schedule a Scan in Microsoft Defender Antivirus in Windows 10  

FrankW said:

@Brink
Hi Shawn, I had an (advanced) scheduled WD task running made by Acer without the Basic trigger tab (it had -trigger 55 as a command argument in the actions tab). I disabled that task and then enabled it again but somehow the command line got corrupted. The other 3 WD tasks still run OK and have this in the actions tab: C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2006.9-0\MpCmdRun.exe with argument -IdleTask -TaskName WdCacheMaintenance
I am looking for the argument for Scheduled Job.
Also the other 3 WD tasks have the path with command without quotes but I have to put quotes otherwise the argument is not accepted (ran Task Scheduler as administrator) . I don't really want to restore my system for this and would appreciate if you can help me with the argument for an advanced scheduled job and let me know why I cannot enter the path without quotes like the other 3 jobs have. I will also check my old File History %systemroot%\System32\Tasks for the original settings.

Edit 5:45 pm
After a reboot the WD Schedule scan Task was automatically reset to its original state with a "1999 date", I ran it manually and I think its OK now, we will see after a while....
Thanks
Frank

Fingers crossed.

FrankW said:

Hi Shawn,
I don't believe my MpPreference is active (working), I changed 2 settings: Set-MpPreference -ScanOnlyIfIdleEnabled $False
Set-MpPreference -DisableCatchupQuickScan $False and observed it for several hours but the Scheduled task did not start.

The ComputerID makes no sense, I scanned my registry and that ID is the GUID for MRT (Malicious Removal Tool). Maybe not used for my W10 version 1909,18363 OS Build 18363.900.

It starts when I run the task manually or start it with a command with a 0x0 return code and Security Center reports the Quick scan OK but I cannot get it to run on its own.

Any suggestions?
Frank

I've noticed that scheduled tasks do not always run when scheduled even though everything is supposingly set to run immediately when scheduled.

Since the task will run when done manually or by command, then there is some unknown condition causing the task to not run when scheduled.

Does your -ScanOnlyIfIdleEnabled value show as False now?

In addition, what do you currently show as the value for the following Set-MpPreference parameters:

• -ScanParameters (still 1 for quick scan?)
• -ScanScheduleDay (still 0 for everyday?)
• -ScanScheduleTime
• -ScanScheduleQuickScanTime

I noticed -ScanScheduleQuickScanTime is set to 00:00 (midnight). You might change it to be the same as -ScanScheduleTime for 02:00 am to see if that may help any.

Double check to make sure your computer is awake and running durring the scheduled scan time.


MRT references the same GUID for the ComputerID, so nothing to worry about there.

Great news @FrankW.

Brink said:

Great news @FrankW.

Hi Shawn,
The Scan jobs crashed this morning after an automatic WD update when I booted and all 4 tasks were set to 1999 again, I may have to do a system restore after all.

The four WD tasks are controlled by:
Task Scheduler and the XLM control files
MpPreference settings
Automatic Maintenance app (Security and Maintenance): and in the registry :HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TaskScheduler/Maintenance
and the registry: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\Taskcache\Tasks
Frank

@FrankW,

Possibly if done from a command prompt at boot since it's outside of Windows.

Brink said:

@FrankW,

Possibly if done from a command prompt at boot since it's outside of Windows.

Hi Shawn,
It's working now after I reset TPM, lost my logon pin but after that WD scanned 3 times (perfect):


Frank