Skip to content

schedule-antivirus-scans-wmi.md

Latest commit

 

History

History
96 lines (69 loc) · 3.56 KB

schedule-antivirus-scans-wmi.md

File metadata and controls

96 lines (69 loc) · 3.56 KB

title: Schedule antivirus scans using Windows Management Instrumentation description: Schedule antivirus scans using WMI ms.service: defender-endpoint ms.localizationpriority: medium author: chrisda ms.author: chrisda ms.custom: nextgen ms.date: 10/20/2025 ms.reviewer: pauhijbr, ksarens, yongrhee manager: bagol ms.subservice: ngp ms.topic: how-to ms.collection:

  • m365-security
  • tier3
  • mde-ngp search.appverid: met150 appliesto:
    • Microsoft Defender for Endpoint Plan 1
    • Microsoft Defender for Endpoint Plan 2
    • Microsoft Defender for Business
    • Microsoft Defender Antivirus

Schedule antivirus scans using Windows Management Instrumentation (WMI)

This article describes how to configure scheduled scans using WMI. To learn more about scheduling scans and about scan types, see Configure scheduled quick or full Microsoft Defender Antivirus scans.

Prerequisites

Supported operating systems

  • Windows
  • Windows Server

Use Windows Management Instruction (WMI) to schedule scans

Use the Set method of the MSFT_MpPreference class for the following properties:

ScanParameters
ScanScheduleDay
ScanScheduleTime
RandomizeScheduleTaskTimes

For more information and allowed parameters, see Windows Defender WMIv2 APIs

WMI for scheduling scans when an endpoint isn't in use

Use the Set method of the MSFT_MpPreference class for the following properties:

ScanOnlyIfIdleEnabled

For more information about APIs and allowed parameters, see Windows Defender WMIv2 APIs.

Note

When you schedule scans for times when endpoints aren't in use, scans don't honor the CPU throttling configuration and will take full advantage of the resources available to complete the scan as fast as possible.

WMI for scheduling scans to complete remediation

Use the Set method of the MSFT_MpPreference class for the following properties:

RemediationScheduleDay
RemediationScheduleTime

For more information and allowed parameters, see Windows Defender WMIv2 APIs.

WMI for scheduling daily scans

Use the Set method of the MSFT_MpPreference class for the following properties:

ScanScheduleQuickScanTime

For more information and allowed parameters, see Windows Defender WMIv2 APIs.

Tip

If you're looking for Antivirus related information for other platforms, see: