This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(176, 9%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAB%3C/text%3E%3C/svg%3E)
Hi,
We want to use the Windows Defender API as documented here:
https://learn.microsoft.com/en-us/windows/win32/lwef/windows-defender-functions
However the given headerfile MPClient.h is missing. In both, WIndows 8.1 SDK and the current Windows 10 SDK.
The main reason for using the header file, or looking into it, is that the type MPCallback_Info, as mentioned on MpScanStart, is not described anywhere.
https://learn.microsoft.com/en-us/windows/win32/lwef/mpscanstart
And ofcourse to get the values behind the documented enumeration values.
This had been asked 3 years ago :
Windows Defender - can't locate MpClient.h
Someone from MS should fix this problem....
Hello @Alexander Benikowski thanks for reporting this issue. I've submitted it internally.
If the answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Hello RitaHan,
In case the SDKs and Documentation get updated, which could take some time, is it possible for us to get our hands on the header file seperately?
We'd switch to the copy included in future SDK releases later on but could start working on our project sooner.
I understand your concern and will try my best to report this issue. However, since Windows Defender is legacy feature and lack of some official documents about related definitions (like MPHANDLE, MPSCAN_TYPE etc.), so it is not suggested to make the header file by yourself or use it before we can confirm that these APIs are official public supported.
So this means, the documented APIs on MSDN, while somewhat documented, are (maybe) not publicly supported?
EDIT: If this API is not supposed to be used, is there an appropiate replacement? Like for running scans (with specific settings) or getting the quarantined threats?
Because lack of related documents so we need further confirmation. For replacement, you can check Antimalware Scan Interface (AMSI) to see if it helps.
Ah.
Thanks for the fast reply.
AMSI does help in case we want to run a scan. But it doesn't seem to support querying quarantine information. That's something we're still looking for atm.
Which API did you use for querying quarantine information?
MpThreatOpen with MPTHREAT_SOURCE_QUARANTINE and enumerate using MpThreatEnumerate
However since the headerfile is missing, and therefore the official values for constants like MPTHREAT_SOURCE_QUARANTINE from MPTHREAT_SOURCE are nowhere to be found, officially, we used some user generated headers. However the output of MpThreatEnumerate never looked convincing. The memory seemed half uninitialized and random.
That's why we're unsure if our declarations are correct. Did we use the wrong constant value? What is MP_MIDL_STRING and how does it affect a struct?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(153.6, 22%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELV%3C/text%3E%3C/svg%3E)
I think This issue is still there because I'm facing the same, that MPClient.h missing from Windows 10 SDK If there is any improvement so please give information regarding this
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(89.60000000000001, 81%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERA%3C/text%3E%3C/svg%3E)
All of these documents are in GitHub, you may try visit their GitHub page and report this as an issue, so they will investigate and update the document, for example take a look at:
https://github.com/MicrosoftDocs/win32/blob/docs/desktop-src/lwef/mpscanstart.md