How to Restore Windows Defender Scheduled Scan Task (MpIdleTask) After Deleting it Accidentally?

Windows Defender’s built-in scheduled task named "Windows Defender Scheduled Scan" or MpIdleTask (if you’ve upgraded from Windows 7) is run by Automatic Maintenance when the system is idle. If you’ve deleted this task by mistake, this post tells you how to get it back in Windows 10. Use any one of the following methods.

Restoring Windows Defender Scheduled Scan from XML file

Download Windows_Defender_Scheduled_Scan.zip, unzip and extract the XML file to desktop.

Open Task Scheduler and go to this folder:

Task Scheduler Library > Microsoft > Windows Defender

Click Import Task…

Browse and select the Windows Defender Scheduled Scan.xml file saved in your Desktop.

Click OK when the Create Task dialog appears.

This restores the Windows Defender Scheduled Scan Task to Task Scheduler.

Contents of the Windows Defender Task ("Windows Defender Scheduled Scan" XML file)

<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.5" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo>
<Description>Periodic scan task.</Description>
<URI>\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan</URI>
</RegistrationInfo>
<Triggers />
<Principals>
<Principal id="LocalSystem">
<UserId>S-1-5-18</UserId>
<RunLevel>HighestAvailable</RunLevel>
</Principal>
</Principals>
<Settings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>true</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<Duration>PT10M</Duration>
<WaitTimeout>PT1H</WaitTimeout>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<DisallowStartOnRemoteAppSession>false</DisallowStartOnRemoteAppSession>
<UseUnifiedSchedulingEngine>true</UseUnifiedSchedulingEngine>
<MaintenanceSettings>
<Period>P1D</Period>
<Deadline>P7D</Deadline>
<Exclusive>false</Exclusive>
</MaintenanceSettings>
<WakeToRun>false</WakeToRun>
<ExecutionTimeLimit>PT72H</ExecutionTimeLimit>
<Priority>7</Priority>
</Settings>
<Actions Context="LocalSystem">
<Exec>
<Command>%ProgramFiles%\Windows Defender\MpCmdRun.exe</Command>
<Arguments>Scan -ScheduleJob</Arguments>
</Exec>
</Actions>
</Task>

Restoring the MpIdleTask from XML file

The task is named MpIdleTask in earlier versions of Windows, and the same task name is used after upgrading to Windows 10. Both methods work fine, but this one uses a different command-line argument.

Download MpIdleTask.zip, unzip and extract the XML file to desktop.

(Note that the Program Files path is set to C:\ in the XML file. If Windows is installed in a different drive in your system, edit the XML file using Notepad, and change the Program File path or drive-letter accordingly.)





Open Task Scheduler and go to this folder:

Task Scheduler Library > Microsoft > Windows Defender

Click Import Task…

Browse and select the MpIdle.xml file saved in your Desktop.

Click OK when the Create Task dialog appears.

This adds back the MpIdle Task to Task Scheduler.

Contents of the Windows Defender Task (MpIdleTask XML file)


<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.3" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo>
<Description>Private Idle Task</Description>
<URI>\Microsoft\Windows Defender\MpIdleTask</URI>
</RegistrationInfo>
<Triggers>
<IdleTrigger>
<Enabled>true</Enabled>
</IdleTrigger>
</Triggers>
<Principals>
<Principal id="LocalSystem">
<UserId>S-1-5-18</UserId>
<RunLevel>HighestAvailable</RunLevel>
</Principal>
</Principals>
<Settings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<Duration>PT1M</Duration>
<WaitTimeout>PT0S</WaitTimeout>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>true</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>true</Hidden>
<RunOnlyIfIdle>true</RunOnlyIfIdle>
<DisallowStartOnRemoteAppSession>false</DisallowStartOnRemoteAppSession>
<UseUnifiedSchedulingEngine>true</UseUnifiedSchedulingEngine>
<WakeToRun>false</WakeToRun>
<ExecutionTimeLimit>PT72H</ExecutionTimeLimit>
<Priority>7</Priority>
</Settings>
<Actions Context="LocalSystem">
<Exec>
<Command>c:\program files\windows defender\MpCmdRun.exe</Command>
<Arguments>-IdleTask -TaskName MpIdleTask</Arguments>
</Exec>
</Actions>
</Task>

Hope this helps!

About the author

Ramesh Srinivasan founded Winhelponline.com back in 2005. He is passionate about Microsoft technologies and has a vast experience in the ITeS industry — delivering support for Microsoft's consumer products. He has been a Microsoft MVP [2003 to 2012] who contributes to various Windows support forums.