How to do a quick/full system scan on a computer running Windows 10 in S mode?

Question

I cannot scan any file on a computer running windows 10 in S mode.

Answer 1

N Y from New York,

As I already responded in your other thread regarding Windows 10 S mode and the Defender Security dialog, these changes seemed planned exactly as Vijay_Verma has also mentioned in his post here.

However, I'd been involved with the original developers of Windows OneCare, Microsoft Security Essentials and later Defender since the early beta days of the older products and so privy to some of the information about how these early products actually operate.

Over time we learned a good bit about how Defender worked on Windows 8.x as well, which though it's of course changed over time, we can assume has only improved.

For example, for your question of how to scan a particular folder or file, especially those on a USB drive, this isn't truly necessary with Defender since Windows 8.  That's because Windows 8 and Windows 10 require the PC processor hardware contain the Streaming SIMD Extensions 2 (SSE2).  SSE2 is an Intel Single Instruction Multiple Data (SIMD) processor supplementary instruction set.  SSE2 extends the MMX Technology and SSE technology with the addition of 144 instructions that deliver performance increases across a broad range of applications.

Many Windows 8 (and 10) applications have code paths that have the SSE2 instruction set.  This includes Defender which benefits with increased performance for things like scanning and other computation intensive portions of its operation.

What this means to your question is that unlike in earlier versions of Microsoft security products such as Microsoft Security Essentials, the Defender developers were able to have it do things like automatically scan the files in a folder as you browse into it with Windows Explorer, pre-scanning any executable files in order to prepare for their potential execution.

What you should understand from this is that along with the generally faster USB 2 and 3 interfaces found on more recent PC hardware, this enables Defender to automatically do what people like yourself always did by hand, removing the need for these archaic manual methods that a computer could really always do faster and more consistently.

So the point isn't that you can't do these mundane manual scanning tasks any longer, it's simply that you don't need to, since Defender and the operating system are already doing them for you, it just isn't telling you that it's being done as it happens so quickly.

The problem here along with your other questions and the concerns of others in this thread is that Microsoft has done most of this silently without telling everyone that it's been done, so rather than feeling safer, the truly anal among us (I include myself here) have become vocal and concerned when changes like the removal of these manual scan options have occurred.

However, for me the difference is that along with a small subset of others who've tested the Defender clients since they first appeared on Windows 8, I'm aware that Defender is already doing this itself.

If you wish to prove this to yourself, simply temporarily disable the SmartScreen and Defender real-time components to avoid their detecting and blocking, then download and place a copy of the completely safe Eicar antivirus test file (.com executable extension) into several folders you'd like to test, then re-enable SmartScreen and Defender and browse to these folders to test.

Rob

Answer 2

Since you came back to your thread, I'll add a bit of information I've learned since posting the above that clarifies some of this.

First, I found this Microsoft Docs - Manage Windows Security in Windows 10 in S mode article, which though written for enterprise security administrators, states pretty much what Vijay and I have been in our posts.  It shows the screen we're seeing and even mentions some of the reasons that the options displayed are different with Windows 10 S mode.

I also need to correct my final paragraph in my previous post, since only later did I realize that I was thinking of the desktop Windows Defender when I mentioned disabling real-time protection, since of course that's one of the items that is missing from the display above, so you can't drop the Eicar file into a folder to test since Defender or SmartScreen would detect and block it like any malware.

The other thing that got me to check was whether PowerShell was still available and along with the following sentence later in that same document "Windows 10 in S mode prevents making changes via PowerShell scripts.", I found this 3rd-party article that states the following.

"Windows 10 in S Mode can’t use command-line shells like PowerShell, Command Prompt, or Bash, either. Various other developer tools are also off limits. You don’t have direct access to the Windows Registry via the Registry Editor, either."

https://www.howtogeek.com/354057/what-is-windows-10-in-s-mode/

So this is another limitation that though it keeps you from doing certain management tasks, also stops lots of malware or other malicious attacks that misuse these tools to take control of systems as well.

The more I learn, the more I realize that Microsoft not only left few legacy API sets, they removed many other vulnerabilities as well, so it should be very difficult for any attacks to succeed, even if the user is less careful or even downright careless.

Hopefully this additional information aids in understanding why I'm not concerned that Microsoft chose to remove these controls, since by taking them out, they also removed some of the items that many less technically capable consumer users have used to reduce their own protection.

Rob

Answer 3

I just bought a new laptop running Windows 10 in S mode.  Unlike a regular version of Windows 10, Windows Defender in Win 10 S mode does not let users to do a quick/full system scan, and a custom scan on a specific folder/file.  My work requires me to access to third party USB flash  drives from other people, I really want to scan those flash USB drives to make sure they have no virus/malware before I access the data on them.  Unfortunately, I cannot find the scan option in Windows Defender on my laptop running Windows 10 in S mode.  I really makes me nervous each time when I plug in a USB flash drive from someone else.  Can anyone show me how to scan files in Windows defender on machine running Windows 10 in S mode?

Thank you very much for help.

Answer 4

Hi N

Greetings! I am Vijay, an Independent Advisor. This was a design choice as Windows Developers felt that since they are not allowing any other app to be installed apart from Microsoft Store apps, hence Win 10 S is very safe. But in my opinion, they missed the threats from files and other sources of viruses.

I would recommend that you submit this as a feedback to Windows team through Feedback Hub

Windows Key+F

Submit your feedback

After posting your feedback, share the link here so that I can upvote your request,

Do let me know if you have any more question or require further help.

Answer 5

If you're not seeing the typical controls within the Virus & protection screen to perform scans, mange real-time protection or otherwise perform most manual tasks then this is exactly the same display I've seen since buying a Surface Go tablet delivered with Windows 10 in S mode about 2 months ago.

On occasion when entering this screen I've received an indication that a "Quick scan is due" (overdue?) and the display of a button to scan.  However, this has never appeared to complete successfully and simply sits and indicates scanning by displaying a succession of dots moving across the screen from left to right, until I eventually tire of this, exit and shut down the device.

A few minutes ago I turned the tablet on, got the same display indication for a quick scan and the same lack of completion results (still scanning per the dots) after 15 minutes or more.  However, at that point a Windows 10 notification window popped up indicating the completion of an update and offering to restart now or later.

Looking in Settings, Windows Update I found that both a Defender definitions and a Windows Defender Antivirus antimalware platform update had just occurred, along with another definition update immediately after.  Upon restarting the device and opening the Windows Security interface, nothing appeared different and a quick scan request was not immediately displayed.

I did, however, notice that the 2019-07 (July) Cumulative Update for Windows 10 Version 1903 (KB4505903) was also waiting to be installed in Windows Update and so proceeded with that instead.

Looking in Windows Security while the cumulative update was being installed, I see that the quick scan is again being offered, but prefer not to confuse things by attempting to run these together.  Once the update completes and the device is rebooted and otherwise appears stable, I'll return to Windows Security and see whether these recent updates have resolved the apparent inability to complete a scan.

I assume from what I've seen so far that the Windows Security interface within Windows 10 S is purposefully designed to be more simple.  With the inherently improved security of Windows 10 S due to the lack of legacy API sets and thus reduced vulnerabilities, as well as the included TPM 2.0, secure boot and attestation capabilities of this (and any other recently Microsoft certified) device, few even recent malware are capable of successfully attacking even without an anti-malware operating.

I'll return to this thread and provide an update once I've attempted the quick scan, likely later today once everything is stable.

Rob