> ## Documentation Index
> Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Run a Microsoft Defender Scan on Windows Server

> Run a Windows Defender scan on Windows Server: check Defender is on, update signatures, run quick, full or custom scans in PowerShell and review threats.

To scan Windows Server with Microsoft Defender Antivirus, open PowerShell as Administrator, update the signatures with `Update-MpSignature`, then run `Start-MpScan -ScanType QuickScan` (or `FullScan`, or `CustomScan -ScanPath "D:\Sites"`). Check results with `Get-MpThreatDetection`. Defender is installed and enabled by default on Windows Server 2016 and later, including 2019, 2022 and 2025.

| Difficulty | Time | Works on | Needs |
| - | - | - | - |
| Beginner | 5 minutes, plus scan time | Windows Server 2019 / 2022 / 2025 | An administrator account |

## Before you start

* Open **PowerShell as Administrator** (right-click **Start** > **Terminal (Admin)**).
* Microsoft Defender Antivirus (often still called Windows Defender) is the antivirus built into Windows. On Windows Server 2016 and later it is installed and turned on by default.
* A full scan reads every file and uses a lot of disk and CPU. On a busy production server, run it outside peak hours.

## How to check Defender is running

```powershell theme={null}
Get-Service -Name windefend
Get-MpComputerStatus | Select-Object AMRunningMode, AntivirusEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated, QuickScanAge, FullScanAge
```

`Status` should be `Running`, `AMRunningMode` should be `Normal`, and both `Enabled` values `True`. `QuickScanAge` and `FullScanAge` are days since the last scan.

If the `WinDefend` service is missing, Defender may have been removed. Reinstall it and restart:

```powershell theme={null}
Install-WindowsFeature -Name Windows-Defender
```

## How to update Defender signatures

```powershell theme={null}
Update-MpSignature
```

Defender gets its security intelligence (signature) updates through Windows Update, so the **Windows Update** service must be able to run. See [install Windows updates](https://help.freakhosting.com/portals/other/how-to-install-windows-updates-on-windows-server.md).

## How to run a scan with PowerShell

> [tab] Quick scan
>
> A faster check of the places malware most often hides, without reviewing every file. Usually takes minutes.
>
> ```powershell theme={null}
> Start-MpScan -ScanType QuickScan
> ```

> [tab] Full scan
>
> Checks every file on every fixed drive. Can take hours on a large disk.
>
> ```powershell theme={null}
> Start-MpScan -ScanType FullScan -AsJob
> ```
>
> `-AsJob` runs it in the background so you can keep working. Check progress with `Get-Job` and results with `Receive-Job`.

> [tab] Custom scan
>
> Scans one folder or file, for example a website folder or a download:
>
> ```powershell theme={null}
> Start-MpScan -ScanType CustomScan -ScanPath "D:\Sites\example.com"
> ```

### Scan from Command Prompt with MpCmdRun

`MpCmdRun.exe` is the command-line tool for Defender. It is in `C:\Program Files\Windows Defender` (the newest copy is under `C:\ProgramData\Microsoft\Windows Defender\Platform\<version>`). In an elevated Command Prompt:

```bat theme={null}
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 1
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 2
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "D:\Sites"
```

`-ScanType 1` is a quick scan, `2` a full scan and `3` a custom scan of the path after `-File`.

## How to scan with Windows Security (GUI)

On Windows Server with Desktop Experience:

**1. Open Windows Security**

Search for **Windows Security** in **Start** and open it.

**2. Open scan options**

Click **Virus & threat protection**, then under **Current threats** click **Scan options**.

**3. Pick a scan**

Choose **Quick scan**, **Full scan** or **Custom scan** and start the scan.

> [!WARNING]
>
> **Microsoft Defender Antivirus (offline scan)** restarts the computer and scans before Windows loads. On a remote server, only use it when you can watch the restart in the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md), because RDP is unavailable while it runs.

## How to see what Defender found

```powershell theme={null}
Get-MpThreatDetection
Get-MpThreat
```

`Get-MpThreatDetection` lists every past and current detection with the time and file path. In the GUI, open **Windows Security > Virus & threat protection > Protection history**. To list quarantined items: `MpCmdRun.exe -Restore -ListAll`.

If a threat shows as active, run `Remove-MpThreat`, then run a full scan. If you find malware on a server, also [check for unknown logins](https://help.freakhosting.com/portals/other/how-to-see-failed-login-attempts-on-windows-server.md) and change your passwords.

## How to exclude a folder from scanning

Only exclude folders when a vendor documents it (for example a database or game server data folder), because excluded files are never scanned:

```powershell theme={null}
Add-MpPreference -ExclusionPath "D:\GameServer\data"
Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
```

Remove it again with `Remove-MpPreference -ExclusionPath "D:\GameServer\data"`. On Windows Server, Defender already adds automatic exclusions for installed server roles; Microsoft warns that turning those off can hurt performance or corrupt data.

## How to check it worked

* `Get-MpComputerStatus` shows a recent `AntivirusSignatureLastUpdated` and `QuickScanAge` of `0` after your scan.
* `Get-MpThreatDetection` returns nothing, or only items that are already removed or quarantined.

## Frequently asked questions

### Is Defender enough antivirus for Windows Server?

Microsoft Defender Antivirus is Microsoft's built-in protection for Windows Server and is on by default. Keep it updated, keep real-time protection on and patch Windows. If you install another antivirus product, check Defender's status afterwards with `Get-MpComputerStatus`, because its running mode can change.

### How do I schedule a regular scan?

Create a task in **Task Scheduler** that runs `powershell.exe -Command "Start-MpScan -ScanType QuickScan"` at a quiet time, for example daily at 04:00.

### Why is real-time protection off?

Another antivirus may have taken over, or a policy may have turned it off. Check `Get-MpComputerStatus` and `AMRunningMode`. Microsoft lists `WinDefend` as a service that must always run.

### Does a full scan slow down my game or web server?

Yes, while it runs. Use quick scans day to day and run full scans at quiet times.

## Related guides

> [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md)
>
> Every guide in this section.

> [card] [Windows Server security checklist](https://help.freakhosting.com/portals/other/windows-server-security-checklist.md)
>
> Every hardening step.

> [card] [Install Windows updates](https://help.freakhosting.com/portals/other/how-to-install-windows-updates-on-windows-server.md)
>
> Keep Windows and Defender current.

> [card] [See failed login attempts](https://help.freakhosting.com/portals/other/how-to-see-failed-login-attempts-on-windows-server.md)
>
> Check who tried to sign in.

> [card] [Fix high CPU usage](https://help.freakhosting.com/portals/other/how-to-fix-high-cpu-usage-on-windows-server.md)
>
> When a scan or process hogs the CPU.

***

> [!NOTE]
>
> **Checked against Microsoft Learn: [Defender Antivirus on Windows Server](https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-on-windows-server), [Start-MpScan](https://learn.microsoft.com/en-us/powershell/module/defender/start-mpscan), [Get-MpComputerStatus](https://learn.microsoft.com/en-us/powershell/module/defender/get-mpcomputerstatus), [MpCmdRun command-line arguments](https://learn.microsoft.com/en-us/defender-endpoint/command-line-arguments-microsoft-defender-antivirus) and [Windows Server exclusions](https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-exclusions-windows-server)** on 4 November 2026. Commands were not tested on a live Windows server for this page.

> [!NOTE]
>
> ### Need Extra Help?
>
> If you encounter any issues, our support team is ready to assist:
>
> * **Live Chat:** Quick assistance via our website.
> * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php)
> * **Discord:** [Join our Community](https://discord.gg/freakhosting)
> * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com)

> [!TIP]
>
> ### Save on Your Hosting
>
> Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order!

***

**Last Updated:** November 2026


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.