Microsoft Defender Offline Scan - batch or schedule


raywood

Well-known member
Member
Local time
3:51 AM
Posts
57
OS
Windows 11 24H2 26100.3476
I'm told I can run a Microsoft Defender Offline Scan with this command:

Code:
PowerShell Start-MpWDOScan

Would I need to add anything to that, to run it in a batch file?

I would experiment, at the price of one or more reboots, but I have another question: how can I schedule such a scan? I would want to be prompted before the reboot; does that mean I'd have to run it in a batch file entered into taskschd.msc?

Also, would this differ in Win10 vs. Win11?
 

My Computer My Computer

At a glance

Windows 11 24H2 26100.3476Intel Core i5-13500G.Skill DDR4 32GB F4-3200C16-32GVKIntel UHD Graphics 770
OS
Windows 11 24H2 26100.3476
Computer type
PC/Desktop
Manufacturer/Model
Various homebuilt
CPU
Intel Core i5-13500
Motherboard
ASUS PRIME H770-PLUS D4
Memory
G.Skill DDR4 32GB F4-3200C16-32GVK
Graphics Card(s)
Intel UHD Graphics 770
PSU
Corsair RM750e ATX
Cooling
DeepCool AK500 Zero Dark

My Computer My Computer

At a glance

Windows 11AMD Ryzen 7 5700GMicron Technology DDR4-3200 16GBNVIDIA GeForce RTX 3060
OS
Windows 11
Computer type
PC/Desktop
Manufacturer/Model
HP Pavilion
CPU
AMD Ryzen 7 5700G
Motherboard
Erica6
Memory
Micron Technology DDR4-3200 16GB
Graphics Card(s)
NVIDIA GeForce RTX 3060
Sound Card
Realtek ALC671
Monitor(s) Displays
Samsung SyncMaster U28E590
Screen Resolution
3840 x 2160
Hard Drives
SAMSUNG MZVLQ1T0HALB-000H1
Thanks for the quick reply. But I don't believe that article addresses any of my questions.
 

My Computer My Computer

At a glance

Windows 11 24H2 26100.3476Intel Core i5-13500G.Skill DDR4 32GB F4-3200C16-32GVKIntel UHD Graphics 770
OS
Windows 11 24H2 26100.3476
Computer type
PC/Desktop
Manufacturer/Model
Various homebuilt
CPU
Intel Core i5-13500
Motherboard
ASUS PRIME H770-PLUS D4
Memory
G.Skill DDR4 32GB F4-3200C16-32GVK
Graphics Card(s)
Intel UHD Graphics 770
PSU
Corsair RM750e ATX
Cooling
DeepCool AK500 Zero Dark
Yes, the command you use will perform an offline scan.

You can use Schtasks command to schedule an offline scan i posted code that uses Schtasks to schedule system shutdown, maybe it will give you ideas.

Code:
@Echo Off
Color 0A
cls
Mode con COLS=40 LINES=20
Rem Add zero before entering single digit time like this 01:23
Set /p a=   "Enter PC Shutdown Time (00:00)>" 
Cls
Schtasks /create  /tn ShutDown /tr ""%SystemRoot%\System32\Shutdown.exe" /s /t 5"   /sc once  /st %a%  /f
Ping -n 5 localhost >nul
Exit
 

My Computer My Computer

At a glance

Windows 11AMD Ryzen 7 5700GMicron Technology DDR4-3200 16GBNVIDIA GeForce RTX 3060
OS
Windows 11
Computer type
PC/Desktop
Manufacturer/Model
HP Pavilion
CPU
AMD Ryzen 7 5700G
Motherboard
Erica6
Memory
Micron Technology DDR4-3200 16GB
Graphics Card(s)
NVIDIA GeForce RTX 3060
Sound Card
Realtek ALC671
Monitor(s) Displays
Samsung SyncMaster U28E590
Screen Resolution
3840 x 2160
Hard Drives
SAMSUNG MZVLQ1T0HALB-000H1

Maybe it makes sense to use the parameter -AsJob

 
Last edited:

My Computer My Computer

At a glance

Microsoft Windows 11 HomeIntel Core i5-13490F2 x 16 Patriot Memory (PDP Systems) PSD516G56...GIGABYTE GeForce RTX 4070 WINDFORCE OC 12G (G...
OS
Microsoft Windows 11 Home
Computer type
PC/Desktop
Manufacturer/Model
MSI MS-7D98
CPU
Intel Core i5-13490F
Motherboard
MSI B760 GAMING PLUS WIFI
Memory
2 x 16 Patriot Memory (PDP Systems) PSD516G560081 6400MT (32-37-37-74); 1.35V)
Graphics Card(s)
GIGABYTE GeForce RTX 4070 WINDFORCE OC 12G (GV-N4070WF3OC-12GD)
Sound Card
Bluetooth Аудио
Monitor(s) Displays
INNOCN 15K1F
Screen Resolution
1920 x 1080
Hard Drives
WD_BLACK SN770 250GB
KINGSTON SNV2S1000G (ELFK0S.6)
PSU
Thermaltake Toughpower GF3 1000W
Case
CG560 - DeepCool
Cooling
ID-COOLING SE-224-XTS / 2 x 140Mm Fan - rear and top; 3 x 120Mm - front
Keyboard
Corsair K70 RGB TKL
Mouse
Corsair KATAR PRO XT
Internet Speed
100 Mbps
Browser
Firefox
Antivirus
Microsoft Defender Antivirus
Other Info
https://www.userbenchmark.com/UserRun/66553205
A problem with both PowerShell & WMI methods in calling for an offline scan, is it restarts Windows immediately and you're never provided an option to cancel.
Code:
powershell Start-MpWDOScan
wmic /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpWDOScan call Start

The only way to get a confirmation prompt is to offline scan from Security Center. But there's a way to use an URI (Uniform Resource Identifier) to script this.
Code:
cmd /c start windowsdefender://wdoscan/

If your scheduled task calls this command, you will be given the option to cancel. The task doesn't require any special privileges since it's opening Security Center.
There should be no differences btw W10 and 11.

Windows 11 x64-2024-12-21-19-04-10.webp
 
Last edited:

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
I found a Microsoft page that seems to say I can run an offline Microsoft Defender Offline Scan with this command:

Code:
wmic /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpWDOScan call Start

Haven't tried it yet.
 

My Computer My Computer

At a glance

Windows 11 24H2 26100.3476Intel Core i5-13500G.Skill DDR4 32GB F4-3200C16-32GVKIntel UHD Graphics 770
OS
Windows 11 24H2 26100.3476
Computer type
PC/Desktop
Manufacturer/Model
Various homebuilt
CPU
Intel Core i5-13500
Motherboard
ASUS PRIME H770-PLUS D4
Memory
G.Skill DDR4 32GB F4-3200C16-32GVK
Graphics Card(s)
Intel UHD Graphics 770
PSU
Corsair RM750e ATX
Cooling
DeepCool AK500 Zero Dark

Latest Support Threads

Back
Top Bottom