Configure and manage Microsoft Defender Antivirus with the mpcmdrun.exe command-line tool
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
- Microsoft Defender Antivirus
You can perform various functions in Microsoft Defender Antivirus using the dedicated command-line tool mpcmdrun.exe. This utility is useful when you want to automate Microsoft Defender Antivirus tasks. You can find the utility in
%ProgramFiles%\Windows Defender\MpCmdRun.exe. Run it from a command prompt.
You might need to open an administrator-level version of the command prompt. When you search for Command Prompt on the Start menu, choose Run as administrator. If you're running an updated Microsoft Defender antimalware platform version, run
MpCmdRun from the following location:
C:\ProgramData\Microsoft\Windows Defender\Platform\<antimalware platform version>. For more information about the antimalware platform, see Microsoft Defender Antivirus updates and baselines.
The MpCmdRun utility uses the following syntax:
MpCmdRun.exe [command] [-options]
Here's an example:
MpCmdRun.exe -Scan -ScanType 2
In our example, the MpCmdRun utility starts a full antivirus scan on the device.
||Displays all available options for the MpCmdRun tool|
||Scans for malicious software. Values for ScanType are:
0 Default, according to your configuration
1 Quick scan
2 Full scan
3 File and directory custom scan.
CpuThrottling runs according to policy configurations.
||Starts diagnostic tracing|
||Captures all the network input into the Network Protection service and saves it to a file at
Supply an empty path to stop tracing.
||Collects support information. See collecting diagnostic data.|
||Restores the installed security intelligence to a previous backup copy or to the original default set.|
||Removes only the dynamically downloaded security intelligence.|
||Restores the previous installed engine.|
||Checks for new security intelligence updates.|
||Restores or lists quarantined item(s).|
||Loads dynamic security intelligence.|
||Lists the loaded dynamic security intelligence.|
||Removes dynamic security intelligence.|
||Checks whether a path is excluded.|
||Verifies that your network can communicate with the Microsoft Defender Antivirus cloud service. This command will only work on Windows 10, version 1703 or higher.|
||Reset platform binaries back to
||Revert platform binaries back to the previously installed version of the Defender platform.|
Common errors in running commands via mpcmdrun.exe
The following table lists common errors that can occur while using the MpCmdRun tool.
|Error message||Possible reason|
|ValidateMapsConnection failed (800106BA) or 0x800106BA||The Microsoft Defender Antivirus service is disabled. Enable the service and try again. If you need help re-enabling Microsoft Defender Antivirus, see Reinstall/enable Microsoft Defender Antivirus on your endpoints.
Note that in Windows 10 1909 or older, and Windows Server 2019 or older, the service was formerly called Windows Defender Antivirus.
|0x80070667||You're running the
|MpCmdRun is not recognized as an internal or external command, operable program, or batch file.||The tool must be run from either
|ValidateMapsConnection failed to establish a connection to MAPS (hr=80070005 httpcode=450)||The command was attempted using insufficient privileges. Use the command prompt (cmd.exe) as an administrator.|
|ValidateMapsConnection failed to establish a connection to MAPS (hr=80070006 httpcode=451)||The firewall is blocking the connection or conducting SSL inspection.|
|ValidateMapsConnection failed to establish a connection to MAPS (hr=80004005 httpcode=450)||Possible network-related issues, like name resolution problems|
|ValidateMapsConnection failed to establish a connection to MAPS (hr=0x80508015||The firewall is blocking the connection or conducting SSL inspection.|
|ValidateMapsConnection failed to establish a connection to MAPS (hr=800722F0D||The firewall is blocking the connection or conducting SSL inspection.|
|ValidateMapsConnection failed to establish a connection to MAPS (hr=80072EE7 httpcode=451)||The firewall is blocking the connection or conducting SSL inspection.|
- Performance analyzer for Microsoft Defender Antivirus
- Configure Microsoft Defender Antivirus features
- Configure and validate Microsoft Defender Antivirus network connections
- Reference topics for management and configuration tools
- Microsoft Defender for Endpoint on Mac
- macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune
- Microsoft Defender for Endpoint on Linux
- Configure Defender for Endpoint on Android features
- Configure Microsoft Defender for Endpoint on iOS features
Submit and view feedback for