Skip to main content
To scan Windows Server with Microsoft Defender Antivirus, open PowerShell as Administrator, update the signatures with Update-MpSignature, then run Start-MpScan -ScanType QuickScan (or FullScan, or CustomScan -ScanPath "D:\Sites"). Check results with Get-MpThreatDetection. Defender is installed and enabled by default on Windows Server 2016 and later, including 2019, 2022 and 2025.

​
Before you start

  • Open PowerShell as Administrator (right-click Start > Terminal (Admin)).
  • Microsoft Defender Antivirus (often still called Windows Defender) is the antivirus built into Windows. On Windows Server 2016 and later it is installed and turned on by default.
  • A full scan reads every file and uses a lot of disk and CPU. On a busy production server, run it outside peak hours.

​
How to check Defender is running

Status should be Running, AMRunningMode should be Normal, and both Enabled values True. QuickScanAge and FullScanAge are days since the last scan. If the WinDefend service is missing, Defender may have been removed. Reinstall it and restart:

​
How to update Defender signatures

Defender gets its security intelligence (signature) updates through Windows Update, so the Windows Update service must be able to run. See install Windows updates.

​
How to run a scan with PowerShell

A faster check of the places malware most often hides, without reviewing every file. Usually takes minutes.

​
Scan from Command Prompt with MpCmdRun

MpCmdRun.exe is the command-line tool for Defender. It is in C:\Program Files\Windows Defender (the newest copy is under C:\ProgramData\Microsoft\Windows Defender\Platform\<version>). In an elevated Command Prompt:
-ScanType 1 is a quick scan, 2 a full scan and 3 a custom scan of the path after -File.

​
How to scan with Windows Security (GUI)

On Windows Server with Desktop Experience:
1

Open Windows Security

Search for Windows Security in Start and open it.
2

Open scan options

Click Virus & threat protection, then under Current threats click Scan options.
3

Pick a scan

Choose Quick scan, Full scan or Custom scan and start the scan.
Microsoft Defender Antivirus (offline scan) restarts the computer and scans before Windows loads. On a remote server, only use it when you can watch the restart in the VNC console, because RDP is unavailable while it runs.

​
How to see what Defender found

Get-MpThreatDetection lists every past and current detection with the time and file path. In the GUI, open Windows Security > Virus & threat protection > Protection history. To list quarantined items: MpCmdRun.exe -Restore -ListAll. If a threat shows as active, run Remove-MpThreat, then run a full scan. If you find malware on a server, also check for unknown logins and change your passwords.

​
How to exclude a folder from scanning

Only exclude folders when a vendor documents it (for example a database or game server data folder), because excluded files are never scanned:
Remove it again with Remove-MpPreference -ExclusionPath "D:\GameServer\data". On Windows Server, Defender already adds automatic exclusions for installed server roles; Microsoft warns that turning those off can hurt performance or corrupt data.

​
How to check it worked

  • Get-MpComputerStatus shows a recent AntivirusSignatureLastUpdated and QuickScanAge of 0 after your scan.
  • Get-MpThreatDetection returns nothing, or only items that are already removed or quarantined.

​
Frequently asked questions

​
Is Defender enough antivirus for Windows Server?

Microsoft Defender Antivirus is Microsoft’s built-in protection for Windows Server and is on by default. Keep it updated, keep real-time protection on and patch Windows. If you install another antivirus product, check Defender’s status afterwards with Get-MpComputerStatus, because its running mode can change.

​
How do I schedule a regular scan?

Create a task in Task Scheduler that runs powershell.exe -Command "Start-MpScan -ScanType QuickScan" at a quiet time, for example daily at 04:00.

​
Why is real-time protection off?

Another antivirus may have taken over, or a policy may have turned it off. Check Get-MpComputerStatus and AMRunningMode. Microsoft lists WinDefend as a service that must always run.

​
Does a full scan slow down my game or web server?

Yes, while it runs. Use quick scans day to day and run full scans at quiet times.

VPS and dedicated server guides

Every guide in this section.

Windows Server security checklist

Every hardening step.

Install Windows updates

Keep Windows and Defender current.

See failed login attempts

Check who tried to sign in.

Fix high CPU usage

When a scan or process hogs the CPU.
Checked against Microsoft Learn: Defender Antivirus on Windows Server, Start-MpScan, Get-MpComputerStatus, MpCmdRun command-line arguments and Windows Server exclusions on 4 November 2026. Commands were not tested on a live Windows server for this page.

​
Need Extra Help?

If you encounter any issues, our support team is ready to assist:

​
Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!
Last Updated: November 2026