Run and customize on-demand scans in Microsoft Defender Antivirus - Microsoft Defender for Endpoint (2024)

Applies to:

• Microsoft Defender for Endpoint Plan 1
• Microsoft Defender for Endpoint Plan 2
• Microsoft Defender for Business
• Microsoft Defender for Individuals
• Microsoft Defender Antivirus

You can run an on-demand scan on individual endpoints. These scans will start immediately, and you can define parameters for the scan, such as the location or type. When you run a scan, you can choose from among three types: Quick scan, full scan, and custom scan. In most cases, use a quick scan. A quick scan looks at all the locations where there could be malware registered to start with the system, such as registry keys and known Windows startup folders.

Combined with always-on, real-time protection, which reviews files when they are opened and closed, and whenever a user navigates to a folder, a quick scan helps provide strong protection against malware that starts with the system and kernel-level malware. In most cases, a quick scan is sufficient and is the recommended option for scheduled or on-demand scans. Learn more about scan types.

Use Microsoft Defender portal to run a scan

1. Go to the Microsoft Defender portal (https://security.microsoft.com) and sign-in.
2. Go to the device page that you would like to run a remote scan.
3. Click on the ellipses (...).
4. Click on Run Antivirus Scan.
5. Under Select scan type, select the radio button for Quick Scan or Full Scan.
6. Add a comment.
7. Click on Confirm.

To check on the status:

1. Under Actions & submissions, select Action Center and then select History tab.
2. Click on Filters.
3. Under the Action Type, check the box for Start antivirus scan.
4. Click on Apply.
5. Select one of the radio button.
6. Under Action Status, you'll see the status such as Completed.

To check on the detections, see Review the results of Microsoft Defender Antivirus scans | Microsoft Learn

Use Microsoft Intune to run a scan

Use endpoint security to run a scan on Windows devices

1. Go to the Microsoft Intune admin center (https://intune.microsoft.com) and sign-in.

2. Choose Endpoint security > Antivirus.

3. In the list of tabs, select Windows 10 unhealthy endpoints or Windows 11 unhealthy endpoints.

4. From the list of actions provided, select Quick Scan (recommended) or Full Scan.

Use devices to run a scan on a single device

1. Go to the Microsoft Intune admin center (https://intune.microsoft.com) and sign-in.

2. From the sidebar, select Devices > All Devices and choose the device you want to scan.

3. Select ...More and select Quick Scan (recommended) or Full Scan from the options.

Use the Windows Security app to run a scan

For instructions on running a scan on individual endpoints, see Run a scan in the Windows Security app.

Use PowerShell cmdlets to run a scan

Use the following cmdlet:

Start-MpScan

Use PowerShell cmdlets to run a quick scan without excluding antivirus exclusions

Use the following cmdlet:

Set-MpPreference -QuickScanIncludeExclusions 1

For more information on how to use PowerShell with Microsoft Defender Antivirus, see Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus and Defender Antivirus cmdlets.

Use the mpcmdrun.exe command-line utility to run a scan

Use the following -scan parameter:

mpcmdrun.exe -scan -scantype 1

For more information on how to use the tool and other parameters, including starting a full scan or defining paths, see Use the mpcmdrun.exe commandline tool to configure and manage Microsoft Defender Antivirus.

Use Windows Management Instruction (WMI) to run a scan

Use the Start method of the MSFT_MpScan class.

For more information about which parameters are allowed, see Windows Defender WMIv2 APIs