Assistance Needed: Windows Defender MpCmdRun.exe Scan Failure (Error 0x8050111c)

Question

Hello

I am experiencing repeated failures when attempting to run scans using the Windows Defender command-line tool (MpCmdRun.exe). Both full scans and quick scans fail with the following error:

Steps I have already tried:

Verified that signature updates are current (-SignatureUpdate reports no updates needed).

Attempted both full (-Scan -ScanType 2) and quick (-Scan -ScanType 1) scans, both fail with the same error.

Checked the log file at C:\Users\g702712\AppData\Local\Temp\MpCmdRun.log, but the details are unclear.

Environment details:

• Windows Defender Service Version: 4.18.26010.5
• Engine Version: 1.1.26020.3
• Antivirus/Antispyware Signature Version: 1.447.125.0
• Running PowerShell as AdministratorSteps I have already tried:
  • Verified that signature updates are current (-SignatureUpdate reports no updates needed).
  • Attempted both full (-Scan -ScanType 2) and quick (-Scan -ScanType 1) scans, both fail with the same error.
  • Checked the log file at C:\Users\g702712\AppData\Local\Temp\MpCmdRun.log, but the details are unclear.
  Environment details:
  • Windows Defender Service Version: 4.18.26010.5
  • Engine Version: 1.1.26020.3
  • Antivirus/Antispyware Signature Version: 1.447.125.0
  • Running PowerShell as Administrator

Could you please advise on what this error code specifically indicates and what steps I should take to resolve it? Should I provide the contents of the MpCmdRun.log file for further analysis?

Best regards,

Haroun.

Answer 1

The provided context does not define error code 0x8050111c for MpCmdRun.exe, so its specific meaning cannot be stated from the available information.

However, the context does describe how Defender scans behave when started via MpCmdRun and how to investigate scan failures:

1. MpCmdRun-based scans (including scheduled scans) are subject to time limits:
   • Quick scans: 1‑day limit
   • Full scans: 7‑day limit If a scan exceeds these limits, it is canceled. This can appear as a failed scan when using MpCmdRun even though the Defender engine itself is functional.
2. Other common reasons scans are canceled or terminated include:
   • Device restarts during the scan
   • Device running on battery during a scheduled full scan
   • Other power‑state changes (sleep/hibernate/Modern Standby) during the scan
3. To investigate what is happening on the device when the scan fails, review the Defender and system event logs:
   • Open Event Viewer → Application and Service Logs → Microsoft → Windows → Windows Defender → Operational and look for scan events (for example, Event ID 1000) around the time the MpCmdRun scan fails.
   • Also review the System log for restart or power‑related events (IDs 6005, 6006, 6007, 6008, 42, 105, 107, 506, 507) that might interrupt the scan.
   • The same information can be obtained via PowerShell:

          # All Defender operational events
          Get-WinEvent -LogName 'Microsoft-Windows-Windows Defender/Operational'
          
          # Only scan events
          Get-WinEvent -LogName 'Microsoft-Windows-Windows Defender/Operational' | where id -eq '1000'
     

4. If Defender is generally encountering errors during scans or malware removal (not just timeouts), the context recommends:
   • Running Windows Update to ensure the Defender platform, engine, and signatures are fully up to date.
   • If update errors occur, manually installing the latest protection updates from the Microsoft Malware Protection Center.

Given the context, the next concrete steps are:

1. Use Event Viewer or Get-WinEvent to confirm whether the MpCmdRun scan is being canceled due to timeout or power/restart events.
2. Ensure the device remains powered, plugged in, and awake for the duration of the scan.
3. Run Windows Update and, if needed, manually update Defender protection components.

The contents of MpCmdRun.log are not described in the context, so they cannot be interpreted here, but correlating its timestamps with the Defender and System event logs should help pinpoint the cause.

---

References:

• Configure and manage Microsoft Defender Antivirus with the MpCmdRun command-line tool
• Troubleshoot Microsoft Defender Antivirus scan issues
• Troubleshoot problems with detecting and removing malware