Where are the -ScheduleJob, -ScanTrigger, and -IdleScheduledJob options for MpCmdRun.exe documented?

kgcode 0 Reputation points
2024-02-01T21:10:27.39+00:00

In the MpCmdRun.exe documentation (https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/command-line-arguments-microsoft-defender-antivirus), the command-line options -ScheduleJob, -ScanTrigger, and -IdleScheduledJob are not documented.

In the standard Windows Defender Schedule Scan task in Task Scheduler in Windows 10, these three undocumented options are used in the scheduled task's command line:

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23110.3-0\MpCmdRun.exe Scan -ScheduleJob -ScanTrigger 55 -IdleScheduledJob

I found this by running the following command and looking at the Task to Run item:

schtasks /query /fo LIST /v /tn "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan"

Where can I find out what these three undocumented MpCmdRun.exe command-line options do?

Windows 10
Windows 10
A Microsoft operating system that runs on personal computers and tablets.
10,166 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Ian Xue (Shanghai Wicresoft Co., Ltd.) 27,431 Reputation points Microsoft Vendor
    2024-02-05T06:29:16.04+00:00

    Hi kgcode,

    Thanks for your post. Based on my research, the supported command line are listed in the reference document as yours. Use the command line to manage Microsoft Defender Antivirus | Microsoft Learn For the -ScheduleJob, -ScanTrigger, and -IdleScheduledJob, although we can run as a result, we cannot guarantee the result because they are not supported by Microsoft official. I also try to run it but always terminates with 0x2 which means can't find or access the program. Just for your reference an hope it helpful.

    Best Regards,

    Ian Xue


    If the Answer is helpful, please click "Accept Answer" and upvote it.

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.