How to Configure Windows Defender Antivirus Scans Using PowerShell

Microsoft Defender (formerly Windows Defender) is deeply integrated into Windows 11 and Windows Server. While the Windows Security GUI is user-friendly, system administrators managing multiple machines or configuring servers without a desktop experience need a way to control antivirus scans programmatically. The MpCmdRun.exe utility is obsolete; PowerShell provides a modern, robust module for managing Defender.

Initiating Scans via PowerShell

The Start-MpScan cmdlet allows you to trigger malware scans immediately. You must run these commands in an elevated (Administrator) PowerShell prompt.

• Quick Scan: Checks the areas of the system most likely to be infected (registry, startup folders, active memory).

  Start-MpScan -ScanType QuickScan

• Full Scan: Checks every file on the system. Depending on the disk size, this can take several hours.

  Start-MpScan -ScanType FullScan

• Custom Scan: Scans a specific folder or file, which is highly useful for scanning a downloaded archive before extracting it.

  Start-MpScan -ScanType CustomScan -ScanPath "C:\Downloads\SuspiciousFolder"

Updating Antivirus Signatures

Before running a manual scan, it is critical to ensure the threat intelligence definitions are up to date. You can force an update using the Update-MpSignature cmdlet:

Update-MpSignature

If you need to specify the source of the update (e.g., bypassing a local WSUS server to grab updates directly from Microsoft), you can use the -UpdateSource parameter:

Update-MpSignature -UpdateSource MicrosoftUpdateServer

Configuring Scan Exclusions

In enterprise environments, certain applications (like database servers or hypervisors) can suffer severe performance degradation if their working directories are constantly scanned. You can add exclusions using the Add-MpPreference cmdlet.

To exclude a specific directory from real-time and scheduled scans:

Add-MpPreference -ExclusionPath "C:\SQLData"

To exclude a specific process from being monitored:

Add-MpPreference -ExclusionProcess "sqlservr.exe"

Warning: Only add exclusions when absolutely necessary, as they create blind spots in your security posture.

By leveraging the Defender PowerShell module, administrators can seamlessly integrate antivirus management into their existing automation scripts and server deployment pipelines.