>

Run a Microsoft Defender scan from the command line

Kick off quick, full, custom, or offline boot scans with PowerShell or the MpCmdRun.exe utility — no GUI clicking required.

WindowsTerminalsecurityDiagnosticsLow risk
Run `Start-MpScan -ScanType QuickScan` in PowerShell for a quick scan, `-ScanType FullScan` for the whole system, or `-ScanType CustomScan -ScanPath "D:\"` for one folder.

01Command

Command
$ Start-MpScan -ScanType QuickScan

02What it does

Start-MpScan is the PowerShell front-end for the Defender engine and runs synchronously, so the prompt blocks until the scan finishes. The classic alternative is Defender's native CLI: `"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 1` (quick), `-ScanType 2` (full), or `-ScanType 3 -File "D:\folder"` (custom path), plus `-Scan -ScanType 3 -File <path> -DisableRemediation` for detect-only runs. For malware that survives a normal boot, use a Microsoft Defender Offline scan via Windows Security > Virus & threat protection, since it runs before Windows loads. Results and history appear with `Get-MpThreatDetection` and `Get-MpThreat`.

03Risk

RiskLow risk
RequirementsNo elevation needed for quick/full scans; Defender must be the active antivirus (not replaced by third-party security software).
!Warning: A FullScan can run for many hours and hammers the disk — schedule it for idle time rather than running it mid-workday on a production machine.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • Start-MpScan | Microsoft Learn
    Microsoft · vendor-doc · 2026-09-17
    Evidence: Microsoft documents Start-MpScan with -ScanType values QuickScan, FullScan, CustomScan and CpuScanLimit for Microsoft Defender scans.
  • Configure and run scans with mp_cmdrun.exe | Microsoft Learn
    Microsoft · vendor-doc · 2026-09-17
    Evidence: Microsoft documents the MpCmdRun.exe command-line tool with -Scan -ScanType 1/2/3 parameters for running quick, full and custom scans.

Last verified: 2026-09-17 · Category: Security & Privacy

06Related solutions

Scan and repair Windows system files with SFC
WindowssystemTerminalDiagnostics

Use the System File Checker to verify every protected Windows system file against known-good copies and automatically replace the damaged ones.

Low risk ✓ 2026-09-17
Fix 'scripts is disabled on this system' with Set-ExecutionPolicy
WindowsTerminaldevelopersecurity

Understand PowerShell's execution policy scopes and set the one that lets you run your own local scripts without gutting the security model.

Medium risk ✓ 2026-09-17
Repair the Windows component store with DISM RestoreHealth
WindowssystemTerminalDiagnostics

Use the Deployment Image Servicing and Management tool to detect and repair corruption in the Windows component store, the layer SFC depends on.

Medium risk ✓ 2026-09-17