Library Pack Header

The Windows Defender Management library pack gives an understanding of the Windows Defender landscape. The core points of Windows Defender are that both the Engine and Signature files are up to date and that scans are regularly running and the pack delivers this knowledge.\n\nThere are two dashboards to use. The first, Overview gives an understanding of the landscape compliance in terms of engine versions and Defender functionality enabled.\n\nThe second, Signatures and Scans ensures that the software is up to date from a antivirus signature and scanning perspective.

Windows Defender Management

Provides a set of fields with information about engine, product version, full and quick scans age, definition files (last update) and status of several components.\n\nNote that when using this Remote Action, if a device has never completed a Windows Defender scan we set the output for 'full scan age' to a special value of '9999'.

The script should be executed every 1 day.

Get Windows Defender information

Version of the Windows Defender Engine component

Engine version

Product version

Number of days since that the last full scan was performed

Full scan age

Number of days since that the last quick scan was performed

Quick scan age

Number of days since the last anti spyware definition update

AntiSpyware signature age

Number of days since the last anti virus definition update

Antivirus signature age

Number of days since the last network inspection system definition update

NIS signature age

If anti spyware protection is enabled or not

AntiSpyware enabled

If anti virus protection is enabled or not

Antivirus enabled

If behavior monitor component is enabled or not

Behavior monitor enabled

If Internet downloads, Outlook and attachments protection is enabled or not

Ioav protection enabled

If network inspection system is enabled or not

NIS enabled

If on access protection is enabled or not

On access protection enabled

If the device does not have the last version of the Windows Defender malware or spyware definition, it will force an update.

Maximum random delay set to avoid overloading the network. Provide number of seconds less than 600

Maximum delay in seconds

If set to 'true' it will update from an internal service such as WSUS or System Center. If set to 'false' it will update directly from Microsoft. Acceptable values are 'true' or 'false'

Internal update server

Update Windows Defender definition

Modifies several parameters of Windows Defender configuration to perform a custom scheduled scan of devices.

Frequency to run the scan. Accepted value is one of the following ('Everyday', 'Sunday', 'Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday', 'Saturday', 'Never')

Schedule day

Time of the day to run the scan. Provide a valid time in a desired format. For understanding different date time formats check this [https://docs.microsoft.com/en-us/dotnet/standard/base-types/custom-date-and-time-format-strings link]

Schedule time

Type of scan to be executed. Accepted values are ('Quick', 'Full'). For understanding the difference between Quick and Full scans, check this [https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus#quick-scan-versus-full-scan link]

Scan type

Indicates whether to start scheduled scans only when the computer is not in use. Accepted values are ('true', 'false')

Scan only when device is not used

Set Windows Defender scheduled scan

VM Windows 10 x64 (Multi-language) (1803/1809/1903)

A Windows Defender scan is triggered automatically, depending on the type of scan and the time passed since the last one.

Maximum random delay set to avoid overloading the network. Provide number of seconds lower than 600

Type of scan to be executed. Please refer to the Remote Action description for scan details link]

Location where the scan is executed during a Quick or Full scan

Scan location

Minimum number of days to have passed since the last scan to execute a new Quick or Full scan. Provide a number of days lower than 60. To force the execution of the scan in any case, provide a value of 0

Last scan threshold in days

Campaign launch to warn the end user about possible performance implications while executing a Full scan

Full scan campaign ID

Campaign launch to warn the end user that the device will restart during an Offline scan

Windows Defender Management

Description

Screenshots

Versions

Content

Required Products

Platforms

Compatibility