Windows Defender is the default antivirus software in Windows 10 and is no less than any third-party antivirus software. In fact, when it comes to system resource usage, Windows Defender is one of the best. Though the Windows Defender GUI is pretty easy to use, you can also use the Windows Defender via command prompt. This is especially useful when you are creating your own scripts or scheduled tasks.
The Windows Defender command line lets you do all the basic things like performing different types of scans, listing and restoring quarantined files, adding dynamic signatures and removing or updating the virus definitions. This article will show you how to use Windows Defender from the command prompt.
Use Windows Defender from Command Prompt
To run Windows Defender via Command Prompt, you need to have administrative privileges, so search for Command Prompt in the Start menu and select the “Run as Administrator” option. You can also right-click and select “Run as Administrator.”
If you’ve ever used Windows Defender GUI, you will know that it has three scan types. Bow are some quick explanations of what those different scan types mean.
Quick Scan: As the name suggests, Quick Scan is fast and only looks in the most common places like registry keys and start-up folders where the malware or virus could have an affect. Typically, Quick Scan is completed in minutes. In the command line Quick Scan is denoted by -ScanType 1.
Full Scan: Full scan performs an in-depth scan on your entire system. Depending on how many files you have in your system, the scan can take hours to complete. In the command line Full Scan is denoted by -ScanType 2.
Custom Scan: Custom scan lets you perform an in-depth scan on a specific drive, folder, or file. In the command line, Custom Scan is denoted by -ScanType 3 and has additional switches to tell what file or folder to scan.
If you want to perform a quick scan, you can use the below command.
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 1
For a full scan, simply replace 1 in the above command with 2.
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 2
To perform a quick scan, use the below command while replacing “D:\Folder\Path” with the actual folder or file path.
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "D:\Folder\Path"
Windows Defender also has another scan type that scans the system boot sector for any infections. A boot sector virus infects the Master Boot Record which in turn infects the entire system when you boot up the system. To perform a boot sector scan, use the below command.
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType -BootSectorScan
To cancel the scan, simply press the keyboard shortcut Ctrl + C.
When Windows Defender finds a threat, it moves it to the Quarantine so that it doesn’t infect your system. However, false positives can happen, and if you think Windows Defender moved a legitimate file to Quarantine, you can restore it quite easily. First, use the below command to list all the Quarantined Files.
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Restore -ListAll
From the list, identify the file and note its name. Next, execute the below command while replacing “FileName” with the actual file name you want to restore. If the command is executed successfully, the file restores to its original location.
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Restore -Name "FileName"
In general, Windows Defender automatically updates itself with latest antivirus definitions. However, if you want to make sure Windows Defender is up to date, execute the below command.
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -SignatureUpdate
That is it. As you can see, the Windows Defender command-line options are quite user-friendly and easy to use. If you are interested, take a look at this Microsoft Docs page to get to know more about other commands that let you list, add, or remove dynamic signatures, check execution path, diagnostic tracing, etc.
Comment below sharing your thoughts and experiences about using Windows Defender from the command line.
Vamsi is a tech and WordPress geek who enjoys writing how-to guides and messing with his computer and software in general. When not writing for MTE, he writes for he shares tips, tricks, and lifehacks on his own blog Stugon.
