Edit

Schedule antivirus scans using Windows Management Instrumentation (WMI)

  • Article

Applies to:

Platforms

  • Windows

This article describes how to configure scheduled scans using WMI. To learn more about scheduling scans and about scan types, see Configure scheduled quick or full Microsoft Defender Antivirus scans.

Use Windows Management Instruction (WMI) to schedule scans

Use the Set method of the MSFT_MpPreference class for the following properties:

ScanParameters
ScanScheduleDay
ScanScheduleTime
RandomizeScheduleTaskTimes

For more information and allowed parameters, see Windows Defender WMIv2 APIs

WMI for scheduling scans when an endpoint is not in use

Use the Set method of the MSFT_MpPreference class for the following properties:

ScanOnlyIfIdleEnabled

For more information about APIs and allowed parameters, see Windows Defender WMIv2 APIs.

Note

When you schedule scans for times when endpoints are not in use, scans do not honor the CPU throttling configuration and will take full advantage of the resources available to complete the scan as fast as possible.

WMI for scheduling scans to complete remediation

Use the Set method of the MSFT_MpPreference class for the following properties:

RemediationScheduleDay
RemediationScheduleTime

For more information and allowed parameters, see Windows Defender WMIv2 APIs.

WMI for scheduling daily scans

Use the Set method of the MSFT_MpPreference class for the following properties:

ScanScheduleQuickScanTime

For more information and allowed parameters, see Windows Defender WMIv2 APIs.

Tip

If you're looking for Antivirus related information for other platforms, see:

Tip

Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender for Endpoint Tech Community.