Update Microsoft Defender and run a scan

Update Microsoft Defender Antivirus signatures on a Windows device and start a quick scan, then report a one-line verdict. For MSPs and IT teams who want "I clicked a suspicious link" and "Defender says its definitions are out of date" fixed straight away.

Why use an action instead of asking SuperIT

SuperIT can't update Defender or start a scan in a chat: Update-MpSignature and Start-MpScan are denied by the default command policies, so no approval can release them. This action runs those two fixes as SYSTEM from a reviewed script, isn't checked against command policies, and its authorization policy decides who can run it.

To find out whether Defender is on, how old its signatures are or what it detected recently, just ask SuperIT in chat, for example "is this laptop protected?". Those reads are allowed by default.

When to use it

• "I clicked a link in a strange email, can you scan my PC?"
• "Defender keeps saying its definitions are out of date."
• A ticket investigation finds signatures more than a few days old. An engineer then runs the action on that device from a chat.

What the action does

1. Stops without changing anything if expected_hostname isn't this device's computer name.
2. Checks Microsoft Defender is available on the device.
3. Updates Defender's signatures (Update-MpSignature).
4. Starts a quick scan through a scheduled task called SuperIT action - Defender quick scan, which runs as SYSTEM, and returns without waiting.
5. Prints one line: signature version and age, whether real-time protection is on, and that the scan was started.
6. Fails the run if the signature update failed, after still starting the scan.

A quick scan can take longer than the action's timeout (5 minutes by default), so the action hands it to a scheduled task and doesn't wait. The scan then keeps running after the action ends. "Started" means the task started, not that the scan finished: ask SuperIT afterwards "when did Defender last scan this device?" to confirm it did. The task stays on the device with no trigger, so it runs only when this action starts it.

What it doesn't do:

• It doesn't change Defender settings, exclusions or tamper protection, and it doesn't turn Defender on.
• It doesn't remove threats beyond what Defender does on its own, and it doesn't run full or offline scans.
• It doesn't report on Microsoft Defender for Endpoint alerts in the cloud portal.

Before you begin

• A Windows 10, 11 or Server 2016 or later device with the SuperIT RMM agent, online. Actions run on Windows devices only; the macOS and Linux agents are in Beta and can't run actions. See Requirements.
• Your role. Creating an action in a chat needs the Admin role. Engineers and Admins can build it under Workflows → Actions.
• No credential. See Credentials.
• An authorization policy, only if end users should be able to ask for it. With None, only Engineers and Admins can run it, without approval. To let end users ask, link a policy with a rule Requester Anyone, Approver Require approval from an engineer group, such as superit:engineers. See Authorization policies and approvals.

Build it with SuperIT

Create an action called "Update Microsoft Defender and run a scan".
Runtime: PowerShell, running on the device as SYSTEM (execution target: device).
Input: expected_hostname (string, required).
Stop before changing anything unless expected_hostname matches $env:COMPUTERNAME.
Fail clearly if Get-MpComputerStatus isn't available. Run Update-MpSignature; if it fails, remember the error and carry on.
Start the quick scan through a scheduled task "SuperIT action - Defender quick scan" (SYSTEM, highest, no trigger) that runs MpCmdRun.exe -Scan -ScanType 1, so the scan outlives the action. Don't wait for it.
Print one line from Get-MpComputerStatus: signature version and age, real-time protection on or off, quick scan started. Then fail the run if the signature update failed.
Windows PowerShell 5.1 compatible. No authorization policy.

SuperIT confirms the brief, drafts the script, validates it and creates the action as a draft. Review the script, then publish it under Workflows → Actions.

Or build it yourself

Create the action under Workflows → Actions with the PowerShell runtime and this input, then set it to run on a device.

On a device, the script runs in Windows PowerShell as SYSTEM with $ErrorActionPreference = "Stop" already set. Inputs arrive as strings in $ctx.inputs. Invoke-DefenderUpdateAndScan at the top lists the steps in order; each step is a small function below it, and the last line runs it. $result is set as $script:result, because a plain $result = inside a function stays local and never reaches the Result tab.

# Updates Microsoft Defender signatures, starts a quick scan through a scheduled task, and prints a
# one-line verdict. Fails the run if the update failed, after still starting the scan.
function Invoke-DefenderUpdateAndScan {
    param($ExpectedHostname)

    Assert-TargetDevice -ExpectedHostname $ExpectedHostname
    Assert-DefenderAvailable
    Write-Output '=== DEFENDER UPDATE AND SCAN ==='

    $updateError = Update-DefenderSignature
    Start-QuickScan
    $s = Get-MpComputerStatus
    Write-DefenderVerdict -Status $s -UpdateError $updateError

    # $result is read after the script ends, so set it at script scope, not in this function.
    $script:result = @{ signatures_updated = (-not $updateError); signature_version = $s.AntivirusSignatureVersion
                        signature_age_days = $s.AntivirusSignatureAge; realtime = $s.RealTimeProtectionEnabled; scan_started = $true }
    if ($updateError) { throw $updateError }
}

function Assert-TargetDevice {
    param($ExpectedHostname)
    $expected = ("$ExpectedHostname".Trim() -split '\.')[0]
    if (-not $expected) { throw "expected_hostname is required: enter this device's computer name." }
    if ($expected -ne $env:COMPUTERNAME) { throw "This run reached '$env:COMPUTERNAME', not '$expected'. Nothing was changed." }
}

function Assert-DefenderAvailable {
    if (-not (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue)) { throw "Microsoft Defender isn't available on $env:COMPUTERNAME." }
}

function Update-DefenderSignature {
    # Returns the failure instead of throwing: a broken update source shouldn't stop the scan.
    try {
        Update-MpSignature | Out-Null
    } catch {
        "Failed to update Defender signatures on $($env:COMPUTERNAME): $($_.Exception.Message)"
    }
}

function Start-QuickScan {
    # A scheduled task, not a child process: a quick scan can outlast the action's timeout,
    # and a child process may be ended with the action.
    $taskName = 'SuperIT action - Defender quick scan'
    $action = New-ScheduledTaskAction -Execute "$env:ProgramFiles\Windows Defender\MpCmdRun.exe" -Argument '-Scan -ScanType 1'
    $principal = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest
    Register-ScheduledTask -TaskName $taskName -Action $action -Principal $principal -Force | Out-Null
    Start-ScheduledTask -TaskName $taskName
}

function Write-DefenderVerdict {
    param($Status, $UpdateError)
    $updated = if ($UpdateError) { 'update FAILED' } else { 'updated' }
    $realtime = if ($Status.RealTimeProtectionEnabled) { 'on' } else { 'OFF' }
    Write-Output ("Signatures {0} ({1}, {2} day(s) old). Real-time protection {3}. Quick scan started." -f $updated, $Status.AntivirusSignatureVersion, $Status.AntivirusSignatureAge, $realtime)
    if ("$($Status.AMRunningMode)" -like '*Passive*') { Write-Output "Defender is in passive mode: another antivirus is the primary." }
}

Invoke-DefenderUpdateAndScan -ExpectedHostname $ctx.inputs.expected_hostname

Real-time protection that is off doesn't fail the run, because this action can't fix it. In passive mode, where another antivirus is the primary, real-time protection is expected to be off. To remove the scan task from a device, run Unregister-ScheduledTask -TaskName 'SuperIT action - Defender quick scan' -Confirm:$false in an elevated PowerShell there.

Test it

You can't use Test on an action that runs on a device. (On a cloud-sandbox action, Test isn't a dry run either: it runs the script for real and skips approvals.) Every device run really updates and scans, so use a test device.

1. Publish the action under Workflows → Actions.
2. Select Run, enter the test device's computer name in expected_hostname, pick that device under Run target, and select Run action.
3. Check Stdout shows "Signatures updated" with an age of 0 and "Quick scan started".
4. After a few minutes, ask SuperIT "when did Defender last run a quick scan on this device?" and confirm it says today. If it doesn't, the scan didn't run: check the task's last result in Task Scheduler on the device.
5. Run it with a different name in expected_hostname and confirm it fails with "Nothing was changed".

Use it

• In a chat. Select the device and ask "Update Defender and run a quick scan here". SuperIT asks whether to run on the device and fills in expected_hostname. Check it's the device you selected.
• By end users, with approval. With an Anyone → Require approval from rule, an end user can ask SuperIT in self-service chat, for example "I clicked a dodgy link, can you scan my PC?". The run waits for an engineer to approve it. End users see only whether the run succeeded, not its output.
• Not from tickets automatically. Investigations can recommend it on "suspicious email", "pop-up" or stale-signature tickets, but don't switch on Run automatically for this action. A run started from a ticket's Recommended actions panel goes to the action's default device or your team's designated device, not the computer of the person who raised the ticket. To act on a ticket, open a chat, select the device and run it there.
• On a schedule. Ask SuperIT "Run Update Microsoft Defender and run a scan on SRV-FS01 every 7 days, with expected_hostname SRV-FS01", for a server whose own scheduled scans you don't trust. Each schedule is tied to one device.
• For clients. MSPs can publish it to managed teams.

Always pick the device. If no device is chosen, SuperIT runs a device action on the action's default device or your team's designated device, and expected_hostname stops the run if that's the wrong one.

Variations

• Full scan for engineers. Copy the action with -ScanType 2 in the task and a different task name, and no Anyone rule. A full scan can run for hours in the background.
• Scan one file or folder with Start-MpScan -ScanType CustomScan -ScanPath <path>, which is usually quick enough to wait for.
• Update only, without a scan, for devices that report stale signatures in a weekly check.

Related

• Workflows and actions
• Authorization policies and approvals
• Run and schedule actions
• Command policies and approvals
• Revoke sessions for a compromised account