Where are the -ScheduleJob, -ScanTrigger, and -IdleScheduledJob options for MpCmdRun.exe documented?

Question

In the MpCmdRun.exe documentation (https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/command-line-arguments-microsoft-defender-antivirus), the command-line options -ScheduleJob, -ScanTrigger, and -IdleScheduledJob are not documented.

In the standard Windows Defender Schedule Scan task in Task Scheduler in Windows 10, these three undocumented options are used in the scheduled task's command line:

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23110.3-0\MpCmdRun.exe Scan -ScheduleJob -ScanTrigger 55 -IdleScheduledJob

I found this by running the following command and looking at the Task to Run item:

schtasks /query /fo LIST /v /tn "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan"

Where can I find out what these three undocumented MpCmdRun.exe command-line options do?

Answer 1

Hi kgcode,

Thanks for your post. Based on my research, the supported command line are listed in the reference document as yours. Use the command line to manage Microsoft Defender Antivirus | Microsoft Learn For the -ScheduleJob, -ScanTrigger, and -IdleScheduledJob, although we can run as a result, we cannot guarantee the result because they are not supported by Microsoft official. I also try to run it but always terminates with 0x2 which means can't find or access the program. Just for your reference an hope it helpful.

Best Regards,

Ian Xue

---

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.