Configure and manage Windows Defender Antivirus with the mpcmdrun.exe command-line tool

Applies to:

You can perform various Windows Defender Antivirus functions with the dedicated command-line tool mpcmdrun.exe.

This utility can be useful when you want to automate Windows Defender Antivirus use.

You can find the utility in %ProgramFiles%\Windows Defender\MpCmdRun.exe. You must run it from a command prompt.


You may need to open an administrator-level version of the command prompt. Right-click the item in the Start menu, click Run as administrator and click Yes at the permissions prompt.

The utility has the following commands:

MpCmdRun.exe [command] [-options]
Command Description
-? or -h Displays all available options for this tool
-Scan [-ScanType #] [-File [-DisableRemediation] [-BootSectorScan]] [-Timeout ] [-Cancel] Scans for malicious software
-Trace [-Grouping #] [-Level #] Starts diagnostic tracing
-GetFiles Collects support information
-GetFilesDiagTrack Same as Getfiles but outputs to temporary DiagTrack folder
-RemoveDefinitions [-All] Restores the installed Security intelligence to a previous backup copy or to the original default set
-RemoveDefinitions [-DynamicSignatures] Removes only the dynamically downloaded Security intelligence
-RemoveDefinitions [-Engine] Restores the previous installed engine
-SignatureUpdate [-UNC | -MMPC] Checks for new Security intelligence updates
-Restore [-ListAll | [[-Name ] [-All] | [-FilePath ]] [-Path ]] Restores or lists quarantined item(s)
-AddDynamicSignature [-Path] Loads dynamic Security intelligence
-ListAllDynamicSignatures Lists the loaded dynamic Security intelligence
-RemoveDynamicSignature [-SignatureSetID] Removes dynamic Security intelligence
-CheckExclusion -path Checks whether a path is excluded