question

97249451 avatar image
0 Votes"
97249451 asked AllenLiu-MSFT commented

Reasons for Windows Defender Scheduled Quick Scan to stop

Hi,
Does anyone have knowledge about Windows Defender Scheduled Quick Scan stopping without completing?
In our Active Directory environment, Daily Quick Scan is scheduled using MECM's Anti-malware policy.
(I believe it functions as Active Directory group policy does.)
On some of our Windows 10 client PC, the scheduled scan is not executed at all.

I would appreciate if anyone knows reasons why the scan could not be performed or canceled after it started.
Thank you,

mem-cm-general
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

AllenLiu-MSFT avatar image
0 Votes"
AllenLiu-MSFT answered AllenLiu-MSFT commented

Hi, @97249451
Thank you for posting in Microsoft Q&A forum.
To use MECM Anti-malware policy, first make sure that Configuration Manager is configured for Endpoint Protection:
https://docs.microsoft.com/en-us/mem/configmgr/protect/deploy-use/endpoint-protection-configure

We can monitor the quick scan status under the Monitor -> Operations in MECM console, what's the status of your?

And if we try to right click the clients, and trigger the Quick Scan manually, will it executed on clients?
114356-8.jpg


If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.



8.jpg (20.9 KiB)
· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi, @AllenLiu-MSFT
Thank you for answering.
I made sure that Endpoint Protection is configured in Configuration Manager and monitoring operation is available there.

I am sorry but I could not find the way to see the quick scan status.
What I could see under Monitor menu is, for example, Alerts, Reports and so on but Operations.
Could you tell me a little more about how to see the quick scan status, please?

When it comes to manual execution of quick scan as in the photo you attached, it was executed on clients.
Is there any idea for this case?

Thanks,

0 Votes 0 ·

Hi, @97249451
I'm sorry for my mistake, it's Monitor -> Client Operations not Operations.
And did you configured the default policy or a custom policy, if it is a custom, make sure deployed it to the device collection contains the client PC.

0 Votes 0 ·