Defender File Scan Count

Question

Hello,

Can we get count file scanned by defender using powershell?

Answer 1

@Handian Sudianto Apologies for the delayed response, from the above conversation I see you your are looking for PowerShell command which can provide files scanned information.

Researched on the PowerShell cmdlets available for Windows Defender - https://sid-500.com/2023/05/30/administering-windows-defender-with-powershell/

https://learn.microsoft.com/en-us/powershell/module/defender/?view=windowsserver2022-ps

Though we can perform scan from the PowerShell, however it doesnt provide the output results in the PowerShell screen, it can viewed via GUI like you mentioned above.

Also, its not possible get this information via event viewer as well, reviewed the events as well - https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide

Any specific reason why you are looking for this information via PowerShell.

Reference: https://answers.microsoft.com/en-us/windows/forum/all/windows-defender-reporting-different-number-of/dd02cdff-0384-4aa1-ba3d-ec9b0d1461eb

Let me know if you have any further questions, feel free to post back.

Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.

Answer 2

Hello,

Thank you for your question and reaching out. I can understand you are having issues related to Counts

Us the power shell command

(Get-WinEvent -LogName 'Microsoft-Windows-Windows Defender/Operational' | Where-Object { $_.Id -eq 1006 }).Count

and see it helps.

Thank you

--If the reply is helpful, please Upvote and Accept as answer--

Answer 3

Hello,

in the GUI we can see files scanned is 34538

but use given PowerShell script showing 0

Answer 4

Hello,

Thanks for your update. Currently i looking the count scan file just for reporting to management to provide evidence that the server is protected by defender and scanning running normally. We will consider to upgrade the 2012 to 2016 soon, so we can monitor scanned file using GUI.