This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(86.4, 74%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ER%3C/text%3E%3C/svg%3E)
I'm trying to configure Windows 11's Windows Defender to only run itself at midnight each day, and at no other time. I've tried going into Task Scheduler and setting a trigger for each of the four sub-tasks to do so, and for the short time the triggers survive they do function correctly, but after around a week the triggers automatically delete themselves and the processes revert to their original seemingly-random timings, which is a problem because Windows Defender Verification seems to be causing lag spikes in programs when it runs and I want to be able to control its run times.
I've run Malwarebytes recently, although I don't know how that could possibly affect anything. I've scanned, both with Windows Defender and Malwarebytes, for malware. I have Process Lasso downloaded to block my games from entering Efficiency mode, so if that's causing a problem let me know.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(179.20000000000002, 50%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMS%3C/text%3E%3C/svg%3E)
Hello，
You can open your event viewer and go to Applications and Services Logs -> Microsoft -> Windows -> TaskScheduler -> Operational
Then filter the event id 141, you will see who delete your task.
If the Answer is helpful, please click "Accept Answer" and upvote it.
Filtering by event ID 141 turns up nothing, but searching for ID 140 gives me logs saying a user named "S-1-5-18", who I have not created, updated the relevant Windows Defender tasks at 7:14 PM today. (This may have been me, as I'm pretty sure the timestamps line up with when I noticed the issue and tried to re-add the triggers again.) I would scroll further to find the actual deleting of the task, but the log won't go that far back.
I've also noticed that in the "Conditions" tab of the four Defender tasks, "Start the task only when idle" is de-activated, but "Stop if computer ceases to be idle" isn't. This seems very strange and made me wonder if this is normal or if something is wrong with whatever program is reverting these tasks back to their default settings.
I've also noticed that whenever I try and view the tasks' last runtimes, the scroll bar snaps back to the left eventually, making it much harder to view the information.