How can you scan from the command line with Windows Defender?

Question

I'm trying to run a Windows Defender scan from the command line. According to the article I found here I should be able to run the following:

"C:\program files\windows defender\mpcmdrun.exe" -scan 0

However, when I run this, I get the following error:

"Bad Command line - Command Line - Option should start with '-' or '/' 0"

Any ideas on what I am doing wrong? To my understanding this should be working?

Answer 1

Simple answer: "C:\program files\windows defender\mpcmdrun.exe" -scan -scantype 2

Elaborated:

1) Open a simple (not elevated) command prompt. It should not be necessary to open an elevated one.

2) Type/copy--> "C:\program files\windows defender\mpcmdrun.exe" -scan -scantype 2

C:\program files\windows defender\mpcmdrun.exe should be the deafult location of mpcmdrun.exe

Using only -scan parameter will use the default settings of Windows defender/essentials

To be certain that it will be performed a full system scan, you need to use the -scantype 2 parameter, like said in the mpcmdrun help.

3) If you have errors, first try to locate where it is the mpcmdrun.exe file on your machine.

This is usually and easily done with a simple search:

From command prompt: dir /a /b /s c:\mpcmdrun.exe

From the run window, shortcut: Windows key + R key (Windows + R), or from Windows vista/7 searchbox (right over the start button, after you have clicked it), or from Windows 8/8.1 charm search, or from Windows 8/8.1 - right-click on the start button - run:

cmd /k dir /a /b /s c:\mpcmdrun.exe

Extracted from the mpcmdrun help:

-Scan [-ScanType #] [-File <path> [-DisableRemediation]]  Scans for malicious software
-Scan [-ScanType value]
        0  Default, according to your configuration
        1  Quick scan
        2  Full system scan
        3  File and directory custom scan

           [-File <path>]
                Indicates the file or directory  to be scanned, only valid for custom scan.

Answer 2

Type directly from start-run:

cmd /k c:\progra~1\window~2\MpCmdRun.exe -signatureupdate && c:\progra~1\window~2\MpCmdRun.exe -scan -scantype 2

Output:

Signature update started . . .

Signature update finished. No updates needed

Scan starting...

Scan finished.

If it should not work, check the real pathnames of "c:\program files" and "c:\program files\windows defender"; type directly from start-run:

cmd /k dir c:\pro* /x

Output:

22/01/2013 22.38 PROGRA~1 Program Files

09/02/2013 21.14 PROGRA~2 Program Files (x86)

Type directly from start-run:

cmd /k dir c:\progra~1\windows* /x

Output:

25/11/2012 20.56 WINDOW~2 Windows Defender

25/11/2012 20.56 WIA843~1 Windows Journal

25/11/2012 20.56 WI6A8C~1 Windows Mail

13/01/2013 14.23 WI54FB~1 Windows Media Player

26/07/2012 09.13 WI7A8C~1 Windows Multimedia Platform

26/07/2012 09.12 WINDOW~3 Windows NT

25/11/2012 20.56 WINDOW~4 Windows Photo Viewer

26/07/2012 09.13 WIBFE5~1 Windows Portable Devices

Answer 3

The 0 is being detected as an argument. Remove it and try again (the 0 is the default anyway).