The Windows Defender command-line utility
MpCmdRun.exe is prominently used for scheduling scans and updating the signature or definition files. The MpCmdRun.exe command usage info can be obtained by running MpCmdRun.exe with “
/?” or without any parameter.
However, it doesn’t mention a useful switch that updates Windows Defender signatures and runs a Quick Scan at once. And this switch is not documented anywhere so far.
MpCmdRun.exe — Signature Update & Quick Scan
To update the definitions and run a Quick Scan in one go, use the switch SignatureUpdateAndQuickScan
"C:\Program Files\Windows Defender\MpCmdRun.exe" /SignatureUpdateAndQuickScan
… and the event (1001) is written to
Microsoft-Windows-Windows Defender/Operational event log.
This switch works on Windows 8 and Windows 10.
Generally, if a feature or hidden “switch” in a software program is not documented officially, there is a chance that the manufacturer may have missed updating the help files. However, if you’re someone who doesn’t take anything for granted, you could test such hidden feature on a test computer, just in case.
I’ve used and tested the undocumented
SignatureUpdateAndQuickScan in my production computer, and the switch worked exactly as intended without any issues.
Other MpCmdRun.exe command-line switches
Here are the other commonly used MpCmdRun.exe command-line switches:
Run a Quick Scan
"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 1
Run a Full Scan
"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 2
Update the Definitions
"C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate
To see the complete list, open a Command Prompt window and type:
"C:\Program Files\Windows Defender\MpCmdRun.exe"
One small request: If you liked this post, please share this?One "tiny" share from you would seriously help a lot with the growth of this blog. Some great suggestions:
- Pin it!
- Share it to your favorite blog + Facebook, Reddit
- Tweet it!