Windows · Windows PowerShell 5.1
Microsoft Defender Antivirus status on this PC
Is Microsoft Defender Antivirus running on this device with real-time protection on, how old are its signatures, and when did it last finish a quick and a full scan?
Script
#Requires -Modules Defender
# Microsoft Defender Antivirus status on this device. Read-only.
Get-MpComputerStatus |
Select-Object AMRunningMode, AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled,
BehaviorMonitorEnabled, IoavProtectionEnabled, OnAccessProtectionEnabled,
AntivirusSignatureVersion, AntivirusSignatureLastUpdated, AntivirusSignatureAge,
QuickScanEndTime, QuickScanAge, FullScanEndTime, FullScanAge
Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.
Where to run it
The Windows device you want to check, in Windows PowerShell 5.1.
Reading the output
- Every value comes from Get-MpComputerStatus, the antimalware status the device reports about itself. The properties shown are the ones in Microsoft's example output for the cmdlet.
- AMRunningMode shows the mode Defender Antivirus is running in (Normal in Microsoft's example).
- A FullScanAge of 4294967295 with an empty FullScanEndTime, as in Microsoft's example output, means no full scan time is recorded.
Sources
The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.