Evaluate Microsoft Defender Antivirus using PowerShell

Applies to:

• Microsoft Defender Antivirus
• Microsoft Defender for Endpoint Plan 1 and Plan 2

In Windows 10 (or newer) and Windows Server 2016 (or newer), you can use next-generation protection features offered by Microsoft Defender Antivirus with exploit protection.

This article explains how to enable and test the key protection features in Microsoft Defender Antivirus with exploit protection, and provides you with guidance and links to more information.

We recommend you use our evaluation PowerShell script to configure these features, but you can individually enable each feature with the cmdlets described in the rest of this document.

For more information about our endpoint protection products and services, see the following resources:

• Next-generation protection overview
• Microsoft Defender Antivirus in Windows
• Microsoft Defender Antivirus on Windows Server
• Protect devices from exploits

This article describes configuration options in Windows 10 or newer and Windows Server 2016 or newer. If you have any questions about a detection that Microsoft Defender Antivirus makes, or you discover a missed detection, you can submit a file to us at our sample submission help site.

Use PowerShell to enable the features

This guide provides the Microsoft Defender Antivirus cmdlets that configure the features you should use to evaluate our protection.

To use these cmdlets, open PowerShell as an administrator, run a command, and then press Enter.

You can check the status of all settings before you begin, or during your evaluation, by using the Get-MpPreference PowerShell cmdlet.

Microsoft Defender Antivirus indicates a detection through standard Windows notifications. You can also review detections in the Microsoft Defender Antivirus app.

The Windows event log also records detection and engine events. See the Microsoft Defender Antivirus events article for a list of event IDs and their corresponding actions.

Cloud protection features

Standard definition updates can take hours to prepare and deliver; our cloud-delivered protection service can deliver this protection in seconds.

For more information, see Cloud protection and Microsoft Defender Antivirus.

Always-on protection (real-time scanning)

Microsoft Defender Antivirus scans files as soon as they're seen by Windows, monitors any running processes for known or suspected malicious behaviors. If the antivirus engine discovers malicious modification, immediately blocks the process or file from running.

For more information on these options, see Configure behavioral, heuristic, and real-time protection.

Potentially Unwanted Application protection

Potentially unwanted applications are files and apps that aren't traditionally classified as malicious. Such applications include non-Microsoft installers for common software, ad-injection, and certain types of toolbars in your browser.

Email and archive scanning

You can set Microsoft Defender Antivirus to automatically scan certain types of email files and archive files (such as .zip files) when they're seen by Windows. For more information, see Managed email scans in Microsoft Defender.

Manage product and protection updates

Typically, you receive Microsoft Defender Antivirus updates from Windows update once per day. However, you can increase the frequency of those updates by setting the following options, and ensuring that your updates are managed either in System Center Configuration Manager, with Group Policy, or in Intune.

Advanced threat and exploit mitigation and prevention Controlled folder access

Exploit protection provides features that help protect devices from known malicious behaviors and attacks on vulnerable technologies.

Some rules might block behavior you find acceptable in your organization. In these cases, change the rule from Enabled to Audit to prevent unwanted blocks.

Enable Tamper Protection

In the Microsoft Defender portal, go to Settings > Endpoints > Advanced features > Tamper Protection > On.

For more information, see How do I configure or manage tamper protection.

Check the Cloud Protection network connectivity

It's important to check that the Cloud Protection network connectivity is working during your pen testing. Using Command Prompt as an administrator, run the following command:

cd "C:\Program Files\Windows Defender"
MpCmdRun.exe -ValidateMapsConnection

For more information, see Use the cmdline tool to validate cloud-delivered protection.

One-select Microsoft Defender Offline Scan

Microsoft Defender Offline Scan is a specialized tool that comes with Windows 10 or newer, and allows you to boot a machine into a dedicated environment outside of the normal operating system. It's especially useful for potent malware, such as rootkits.

For more information, see Microsoft Defender Offline.

See also

• Microsoft Defender for Endpoint
• Cloud protection and Microsoft Defender Antivirus
• Microsoft Defender Antivirus security intelligence and product updates