How to Check Microsoft Defender Protection Status and Signature Versions in Windows 11 Using PowerShell Get-MpComputerStatus

Auditing endpoint security is an essential responsibility for system administrators, IT support specialists, and security engineers. In Windows 11, Microsoft Defender Antivirus runs as the built-in real-time protection subsystem. While the Windows Security GUI provides a visual overview of protection, automating audits, verifying antimalware definition ages, and checking engine versions across managed endpoints requires command-line telemetry. The PowerShell Get-MpComputerStatus cmdlet retrieves complete operational data directly from the antimalware service provider.

Overview of Get-MpComputerStatus and Security Telemetry

The Get-MpComputerStatus cmdlet queries the Windows Defender management provider (WMI/CIM class MSFT_MpComputerStatus located in the Root\Microsoft\Windows\Defender namespace). It returns comprehensive operational details, including:

• RealTimeProtectionEnabled: Boolean confirming whether active process and file interceptors are functioning.
• AntivirusSignatureVersion and AntivirusSignatureAge: The build number of the virus definitions and the number of days elapsed since the last update.
• AMEngineVersion: The exact core scanning engine binary version running on the operating system.
• BehaviorMonitorEnabled & IoavProtectionEnabled: States of heuristic process behaviour monitoring and downloaded file attachments inspection.
• QuickScanAge and FullScanAge: Days elapsed since the last scheduled or manual quick and deep system scans.
• IsTamperProtected: Confirms whether Tamper Protection prevents unauthorised modifications to registry and service keys.

Running Get-MpComputerStatus in PowerShell

To inspect your local Defender status in an elevated command session:

1. Right-click the Start button on Windows 11 (or press Windows Key + X) and select Terminal (Admin) or PowerShell (Admin).
2. Confirm the User Account Control (UAC) prompt to elevate privileges.
3. Execute the baseline cmdlet:

   Get-MpComputerStatus

4. PowerShell outputs dozens of status properties covering antispyware, antivirus, network inspection, and cloud protection services.

Filtering Critical Protection and Signature Properties

Because the raw output is extensive, piping the cmdlet into Select-Object extracts the most pertinent endpoint health metrics:

Get-MpComputerStatus | Select-Object AntivirusEnabled, RealTimeProtectionEnabled, BehaviorMonitorEnabled, IoavProtectionEnabled, OnAccessProtectionEnabled, IsTamperProtected

To verify signature freshness and engine build versions:

Get-MpComputerStatus | Select-Object AMEngineVersion, AntivirusSignatureVersion, AntivirusSignatureLastUpdated, AntivirusSignatureAge, NISSignatureVersion

If AntivirusSignatureAge exceeds 1 or 2 days, the machine may have connectivity issues reaching Windows Update or Microsoft Defender Security Intelligence servers.

Auditing Scan History and Threat Engine Status

To audit when the endpoint was last scanned for vulnerabilities and zero-day threats:

Get-MpComputerStatus | Select-Object QuickScanStartTime, QuickScanEndTime, QuickScanAge, FullScanStartTime, FullScanEndTime, FullScanAge

You can also construct a quick one-line health assessment that flags outdated signatures or disabled real-time monitoring:

$status = Get-MpComputerStatus
if ($status.RealTimeProtectionEnabled -and $status.AntivirusSignatureAge -le 1) {
    Write-Host "Microsoft Defender is fully updated and active." -ForegroundColor Green
} else {
    Write-Warning "Attention required: Real-Time Protection is disabled or signatures are stale."
}

Updating Signatures via PowerShell If Definitions Are Stale

If your audit reveals outdated signature definitions, you can immediately initiate an update directly from the same administrative session without opening the Windows Security settings interface:

Update-MpSignature -UpdateSource MicrosoftUpdateServer

Once the download completes, rerun Get-MpComputerStatus | Select-Object AntivirusSignatureVersion, AntivirusSignatureAge to verify that the definition build reflects the current release.