Edit

Share via

Schedule antivirus scans using Windows Management Instrumentation (WMI)

  • Applies to: Microsoft Defender for Endpoint Plan 1, Microsoft Defender for Endpoint Plan 2, Microsoft Defender for Business, Microsoft Defender Antivirus

This article describes how to configure scheduled scans using WMI. To learn more about scheduling scans and about scan types, see Configure scheduled quick or full Microsoft Defender Antivirus scans.

Prerequisites

Supported operating systems

  • Windows
  • Windows Server

Use Windows Management Instruction (WMI) to schedule scans

Use the Set method of the MSFT_MpPreference class for the following properties:

ScanParameters
ScanScheduleDay
ScanScheduleTime
RandomizeScheduleTaskTimes

For more information and allowed parameters, see Windows Defender WMIv2 APIs

WMI for scheduling scans when an endpoint isn't in use

Use the Set method of the MSFT_MpPreference class for the following properties:

ScanOnlyIfIdleEnabled

For more information about APIs and allowed parameters, see Windows Defender WMIv2 APIs.

Note

When you schedule scans for times when endpoints aren't in use, scans don't honor the CPU throttling configuration and will take full advantage of the resources available to complete the scan as fast as possible.

WMI for scheduling scans to complete remediation

Use the Set method of the MSFT_MpPreference class for the following properties:

RemediationScheduleDay
RemediationScheduleTime

For more information and allowed parameters, see Windows Defender WMIv2 APIs.

WMI for scheduling daily scans

Use the Set method of the MSFT_MpPreference class for the following properties:

ScanScheduleQuickScanTime

For more information and allowed parameters, see Windows Defender WMIv2 APIs.

Tip

If you're looking for Antivirus related information for other platforms, see:

  • Last updated on