Command-line Switches to Automate Windows Defender GUI (MSASCui.exe)

Most users know that Windows Defender scans can be automated by using the console tool MpCmdRun.exe with Task Scheduler. But, did you know you can run a scheduled scan interactively (in GUI mode), that is without using Windows Defender’s console utility? This post lists some command-line switches to do that.


Update: MSASCui.exe has been removed by Microsoft as of Windows 10 version 1809. The Windows Defender command-line tool MpCmdRun.exe exists, though.


The Windows Defender executable MSASCui.exe supports the following switches, which you can set to run using Scheduler or by creating desktop shortcuts.

MSASCui.exe (GUI) Supported Switches

Update definitions and then run a Quick Scan

"C:\Program Files\Windows Defender\MSASCui.exe" -UpdateAndQuickScan

Run a Quick Scan

"C:\Program Files\Windows Defender\MSASCui.exe" -QuickScan

Run a Full Scan

"C:\Program Files\Windows Defender\MSASCui.exe" -FullScan

Update the Definitions

"C:\Program Files\Windows Defender\MSASCui.exe" -Update

All you need to do is create a task using Task Scheduler with the appropriate switch as above.

Run it hidden

If you want to run any of the above tasks minimized (in the notification area), add the “-hide” switch in addition.

windows defender command-line switches msascui gui

For example, the following command starts a Quick Scan, but without the Windows Defender program showing up on the screen. You can see the scan status or indicator in the Notification area.



"C:\Program Files\Windows Defender\MSASCui.exe" -QuickScan -hide

Using MpCmdRun.exe Command-Line Utility

Windows Defender console tool MpCmdRun’s basic command-line switches are given below:

Update definitions and then run a Quick Scan

"C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdateAndQuickScan

The above one is again unofficial, and undocumented, which I blogged about earlier. Refer Using MpCmdRun.exe to Update Windows Defender and Run a Quick Scan in One Go.

Run a Quick Scan

"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 1

Run a Full Scan

"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 2

Update the Definitions

"C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate

MpCmdRun.exe supports many additional switches (obviously) than its GUI counterpart. To see the complete list, open a Command Prompt window and type:

"C:\Program Files\Windows Defender\MpCmdRun.exe"

windows defender command-line switches


One small request: If you liked this post, please share this?

One "tiny" share from you would seriously help a lot with the growth of this blog. Some great suggestions:
  • Pin it!
  • Share it to your favorite blog + Facebook, Reddit
  • Tweet it!
So thank you so much for your support. It won't take more than 10 seconds of your time. The share buttons are right below. :)

Ramesh Srinivasan is passionate about Microsoft technologies and he has been a consecutive ten-time recipient of the Microsoft Most Valuable Professional award in the Windows Shell/Desktop Experience category, from 2003 to 2012. He loves to troubleshoot and write about Windows. Ramesh founded Winhelponline.com in 2005.

2 thoughts on “Command-line Switches to Automate Windows Defender GUI (MSASCui.exe)”

  1. Hi Tried your solution(s). Here is what my log file shows. on a windows10 64 bit dell inspiron.

    ————————————————————————————-
    MpCmdRun: Command Line: “C:\Program Files\Windows Defender\MpCmdRun.exe” -SignatureUpdate
    Start Time:

    MpEnsureProcessMitigationPolicy: hr = 0x1
    Start: MpSignatureUpdate()
    Calling MpUpdateStartEx with option 0x1
    Update started
    Update completed with hr: 0x800106ba
    ERROR: Signature Update failed with hr=800106BA
    MpCmdRun: End Time: ‎
    ————————————————————————————-

    Reply

Leave a Comment