Cancel a running Defender Scan using WMI

Question

Hi everyone,

i am currently looking for a way to cancel a running defender scan via WMI.

A workaround would be to use MpCmdRun, e .g

Starting: MpCmdRun.exe -Scan -ScanType 1
Cancel: MpCmdRun.exe -Scan -ScanType -Cancel

But i would like to use a WMI Class Method. I found a lot of information for starting a scan (MSFT_MpSCan Start method) but not for canceling.

https://learn.microsoft.com/en-us/previous-versions/windows/desktop/defender/start-msft-mpscan
Is not helpful at this place!

Thank you in advance for your help!

regards
RFG

Answer 1

Hello there,

Powershell makes this easier to do. To quickly check if Windows Defender is running on your computer and find out the last antivirus definition update date, run the following PowerShell command: Get-MpComputerStatus | Select-Object -Property Antivirusenabled,AMServiceEnabled,AntispywareEnabled,BehaviorMonitorEnabled,IoavProtectionEnabled,NISEnabled,OnAccessProtectionEnabled,RealTimeProtectionEnabled,AntivirusSignatureLastUpdated

Type the following command to temporarily disable Microsoft Defender Antivirus and press Enter: Set-MpPreference -DisableRealtimeMonitoring $true

----------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer–