Use the mpcmdrun.exe command-line tool to configure and manage Windows Defender Antivirus

Applies to:

  • Windows 10


  • Enterprise security administrators

You can use a dedicated command-line tool to perform various functions in Windows Defender Antivirus.

This utility can be useful when you want to automate the use of Windows Defender Antivirus.

The utility is available in %ProgramFiles%\Windows Defender\MpCmdRun.exe and must be run from a command prompt.


You may need to open an administrator-level version of the command prompt. Right-click the item in the Start menu, click Run as administrator and click Yes at the permissions prompt.

The utility has the following commands:

MpCmdRun.exe [command] [-options]
Command Description
- ? or -h Displays all available options for the tool
-Scan [-ScanType #] [-File [-DisableRemediation] [-BootSectorScan]][-Timeout ] Scans for malicious software
-Trace [-Grouping #] [-Level #] Starts diagnostic tracing
-GetFiles Collects support information
-RemoveDefinitions [-All] Restores the installed signature definitions to a previous backup copy or to the original default set of signatures
-AddDynamicSignature [-Path] Loads a dynamic signature
-ListAllDynamicSignature [-Path] Lists the loaded dynamic signatures
-RemoveDynamicSignature [-SignatureSetID] Removes a dynamic signature
-ValidateMapsConnection Used to validate connection to the cloud-delivered protection service
-SignatureUpdate [-UNC [-Path ]] Checks for new definition updates