Run Full Scan, Quick Scan, & Custom Windows Defender Scan via Command Prompt

Just like we run Full Scans, Quick Scans, and Custom Scans in the Windows Defender GUI Interface, we can also do the same via the Command Prompt. The following are the steps.

Run Windows Defender Full Scan using Command Prompt

• Go to the Start menu and open Command Prompt. You can also use the Run Command (WinKey + R) to open Command Prompt(cmd).

• In the Command Prompt, let’s navigate to the Windows Defender Directory using the following command. cd "%ProgramFiles%\Windows Defender"

• This command will navigate to the Windows Defender Directory. Now, let’s perform the Scan using the following command. This will scan all files and drives on the system for potential threats. MpCmdRun.exe -Scan -ScanType 2

• Once we execute the above command, the system will start its scan.

• Since, it is a Full Scan, the process will take a long time. As we are using MpCMDRun, we may not get a real-time update.
• Once the Full Scan is completed, Windows Defender will show the status of the scan via a Notification.

Run Windows Defender Quick Scan using the Command Prompt

In this section, we will check out how to run Windows Defender Quick Scan using the Command Line.

• Go to the Command Prompt.
• In the Command Prompt, let’s navigate to the Windows Defender Directory using the following command. cd "%ProgramFiles%\Windows Defender"

• Now, Enter the Quick Scan CMD Command. This will scan critical system files, memory, and locations where threats are most likely to reside. The command is as follows. MpCmdRun.exe -Scan -ScanType 1

• The command will run Windows Defender Quick Scan. We won’t get a real-time update. At the end of the scan, the system will update the status to Scan Finished.

• Additionally, Windows Defender will notify us.

Note: If you want to log the scan results, then you can add -Log Flag to the above Commands. For Example, for running Quick Scan with Log File, execute the following command. MpCmdRun.exe -Scan -ScanType 1 -Log ScanLog.txt

Run Windows Defender Custom Scan using the Command Prompt

• In the first step, let’s navigate to the Windows Defender Directory. cd "%ProgramFiles%\Windows Defender"

• To run a Custom Scan, the following is the syntax. MpCmdRun.exe -Scan -ScanType 3 -File (path). Here, replace the path with the Directory. For example, if we want to scan the Pictures Folder, then the command is MpCmdRun.exe -Scan -ScanType 3 -File C:\Users\vigne\Pictures

• The system will scan the selected folder and will provide the status of the scan. Depending on the number of files, the Scan may take a longer time to complete.

Run an Offline Scan using the Command Prompt on Windows 11

An Offline Scan in Windows Defender refers to a specialized type of scan that runs outside the regular Windows environment. It is designed to detect and remove deeply embedded or advanced threats, such as rootkits or boot sector viruses, which might evade detection during regular scans because they load into memory along with the operating system. The following are the steps.

• Open Command Prompt and navigate to the Windows Defender Directory using the following command. cd "%ProgramFiles%\Windows Defender"
• Now, execute the Custom Scan Command. MpCmdRun.exe -Scan -ScanType 4

IMPORTANT: When you initiate an offline scan, the computer reboots into a secure, minimal environment created by Windows Defender.

Run Windows Defender Scheduled Scan using the Command Prompt

The command to run a scheduled Windows Defender Scan using the Command Line as follows.

• Open Command Prompt and navigate to the Windows Defender Directory. Enter the following command and execute it. This command will run the Scheduled Scan configured in the Windows Defender Settings. MpCmdRun.exe -Scan -ScheduleJob

Update Virus Definitions using the Command Prompt

• To ensure that the Virus Definitions are up to date, kindly execute the following command. MpCmdRun.exe -SignatureUpdate

• The system will check for the latest updates and update its Virus Database.

Different Types of Windows Defender Scans & their related Flags on Windows 11

Frequently Asked Questions

Take away

For everyday users, Running Windows Defender Scan via Command Prompt may seem like a complex task, these methods can be invaluable for power users and administrators to take full control of their System Security. It can also be beneficial for users where a Graphical User Interface is not available. If you have any queries, kindly let us know in the comments.

Have Queries?

For more awesome articles, stay tuned to Winsides.com. Safe Computing! Peace out!

How to Enable Core Isolation in Windows 11?

• Open Windows Settings using Win Key + I
• Click on Privacy and Security.

You can access Windows Security using the Start Menu too.

How does Core Isolation protect your Windows 11 System?

• Enhanced Protection: Core Isolation provides an additional layer of protection by ensuring that critical system processes run in a secure environment, making it harder for attackers to compromise the Windows 11 kernel.
• Prevention of Code Injection Attacks: By verifying that only signed and trusted code can execute in the system’s kernel, Core Isolation helps prevent code injection attacks, which are a common method used by malware to take control of a system.
• Improved Security for Virtual Machines: For users running virtual machines, it ensures that each VM has its own protected memory space, enhancing overall security in virtualized environments.

Frequently Asked Questions

Take away:

By enabling Core Isolation in Windows 11, users can benefit from enhanced protection against sophisticated attacks, ensuring that their operating system remains secure and reliable.

Have Queries?

Whether you are an individual user concerned about personal data security or a business protecting sensitive information, Core Isolation offers a powerful layer of defense. If you have any questions, kindly let us know in the comments. Stay tuned to Winsides.com. Safe Coding! Peace out!

When to Enable and Disable Real-time Protection on Windows 11?

• Troubleshooting software conflicts: Some legitimate software might conflict with Real-Time Protection, and disabling it temporarily can help diagnose and resolve these issues.
• Installing certain applications: Occasionally, you may need to install software that Windows Security mistakenly identifies as a threat.

This article focuses on How to Enable Real-time Protection in Windows 11 for the above purposes. However, winsides.com strongly advises you to keep this feature turned on always to protect yourself from vulnerabilities. The following are the key steps.

• Open Windows Settings using Win Key + I.
• Click on Privacy and Security.

• Now, click on Windows Security.

• Then, navigate to Virus & Threat Protection.

• Windows Security will open now. Click on Manage Settings under Virus & Threat Protection settings.

• Toggle the Real-time protection switch to ON. Windows 11 will enable Real-Time Protection in Windows 11 now.

Note: By default, this feature will be ON. This section is for informative purposes only.

Disable Real-Time Protection in Windows 11- What happens?

If you disable Real-Time Protection Windows 11, it should only be a temporary measure for specific troubleshooting or software installation needs. Always re-enable Real Time Protection as soon as possible to protect your device. By understanding the following risks, you can make an informed decision about temporarily disabling Real-Time Protection. Your device’s security is extremely important, so proceed with caution and ensure your protection is reactivated promptly.

• Increased Vulnerability: Your device will be more susceptible to malware, viruses, and other security threats.
• Potential Data Loss: Disabling this feature increases the risk of data breaches and loss.
• Temporary Measure: Plan to re-enable Real Time Protection as soon as your specific task is complete.
• Consider Alternatives: If necessary, use alternative security measures such as third-party antivirus software during the period Real-Time Protection is disabled.

To Disable Real-Time Protection in Windows 11, go to Virus & Threat Protection Settings. Toggle the Real-Time Protection Switch to OFF to disable this security feature in Windows 11.

Frequently Asked Questions

Take away:

Real-time protection in Windows 11 is a vital feature that continuously shields your device from various security threats, ensuring a safer computing environment. While it is enabled by default to provide ongoing protection, knowing how to manage this feature is crucial for specific scenarios that may require temporary disabling.

Have Queries?

We hope you are satisfied with our article on how to Enable Real-time Protection in Windows 11 and if you have any queries, kindly let us know in the comments. Find more tutorials at our homepage: Winsides.com Happy Coding! Peace out!

IMPORTANT: Ensure the app comes from a trusted source and is not malicious. Only allow apps that are necessary and verified to be safe.

Key Steps:

• Go to Windows Securiy and then to Virus & Threat Protection.
• Navigate to Firewall & Network Protection.
• Click on Allow an App through firewall.
• Select the App that you want to allow.

• Open Windows Settings via WinKey + I.
• You can find the option Privacy & Security on the left pane. Click on that.

• Under Security, click on Windows Security.

• Now, click on Virus & Threat Protection which is available under Protection areas.

• Windows Security will open now. Click on Firewall & Network Protection.

• Click on Allow an app through firewall.

• Windows Firewall Allowed Apps will open now. Click on Change Settings so that the system will allow you to make changes to the Allowed Apps. You might be prompted to enter an Administrator password or confirm your choice.

• Scroll through the list of apps available, and locate the app that you want to allow through Windows Firewall.
• Once you find your app, you can find two check boxes next to it, Private and Public. Private networks are networks that you trust, such as your home or office network. Public networks are networks that you do not trust or not familiar with, such as a public Wi-Fi at a mall or airport. Choose accordingly.
• Finally, click OK to save the changes. Your selected app should now be allowed through Windows Firewall in Windows 11.

Note: You can also use Start menu and Control Panel to access Windows Security in Windows 11.

What if your Allow an app through firewall option is grayed out?

Sometimes, you may not be able to select an app in the firewall settings because the entire section is grayed out, as shown in the image below!

The fix for this issue is to ensure that your firewall is active, as suggested in a Reddit community post. However, I believe you need an administrator account to allow applications through the firewall. Follow these simple steps to do that:

• Press Winkey + S, type Windows Security, and open it.
• Click Firewall & network protection on the left side.
• Scroll down and click Allow an app through firewall.
• At the top-right corner, click Change settings (with a shield icon).
• If prompted, click Yes on the User Account Control (UAC) popup.
• Find the app you want to allow in the list.
• Check the Private and/or Public box as needed.
• Click OK to save the changes.

That’s it, in this way you can run the firewall as administrator and allow an app through the firewall.

What are the Risks of allowing an app through Windows Firewall?

Allowing an app through Windows Firewall introduces several risks, such as unauthorized access and data leakage. If the app has security vulnerabilities or becomes compromised, attackers can exploit these weaknesses to gain unauthorized access to your system, potentially leading to data breaches. Additionally, allowing apps increases your network’s attack surface, providing more opportunities for malware to communicate with command-and-control servers, which can further spread infections or exfiltrate data. Furthermore, allowing unnecessary apps can consume network bandwidth and system resources, affecting overall performance.

When should an App be allowed?

There are three crucial considerations. Trusted Source, Specific need, and Proper Configuration.

1. Ensure the app comes from a trusted source and is not malicious. Only allow apps that are necessary and verified to be safe.
2. Allow the app through the firewall only if it specifically needs network access to function. Unnecessary allowances can create security risks.
3. Configure the firewall to allow only the necessary types of traffic for the app. For example, allow specific ports, protocols, or IP addresses rather than a broad allowance.

Information on the Go!

The principle of “default deny” is a security best practice. It means that by default, all connections are blocked, and only those explicitly allowed are permitted. This minimizes the attack surface and enhances security.

Restore Firewalls to default in Windows 11:

If you wish to restore the Firewall Settings back to its default configuration, follow the below steps.

• Under Firewall and Network Protection, click on Restore firewalls to default.

• Now, Default Settings window will open now. Click on Restore Defaults.

• This option will remove Windows Defender Firewall settings that you have configured for all network locations. Please note that this might cause some apps to stop working.

Take away:

Windows Firewall blocks apps by default, even those from trusted sources, to maintain a high level of security and ensure that only necessary network communications are allowed. This approach helps maintain a secure computing environment and minimizes the risk of unauthorized access and data breaches. By being cautious and selective about which apps are allowed through Windows Firewall, you can minimize potential security risks and maintain a more secure network environment in Windows 11. Safe Computing! Peace out!

Articles References:

• Microsoft Community: Windows Defender Firewall has blocked some features of this app. Retrieved from Microsoft Community Answers on 04.02.2025
• Microsoft Community: Which Apps Should I Allow through Defender Firewall. Retrieved from Microsoft Community Answers on 04.02.2025
• Microsoft Community: I cannot allow an app through firewall – and security settings have been changed but not by me!. Retrieved from Microsoft Community Answers on 04.02.2025
• Reddit Community: Allow an app through firewall” button is greyed out. Retrieved from Reddit Community on 04.02.2025
• Youtube Video Community: How to Allow Apps Through Firewall on Windows 10? Retrieved from DO IT / mostafa ahmed Youtube Channel video on 04.02.2025

• Open Run Command and execute the following command. appwiz.cpl

• Click on Turn Windows Features on or off from the left pane.

• Locate the Microsoft Defender Application Guard and click on the checkbox next to it. Finally, click OK.

• Windows will search for the required files.

• Then, the necessary changes will be applied.

• Click Restart if you are prompted to restart or click Close accordingly. However, it is suggested that the changes be restarted right away so that they will be reflected.

• Microsoft Defender Application Guard (MDAG) is now enabled in Windows 11.

This optional Feature is exclusive to Windows Professional Editions, and hence it is not availble in Windows Home Edition which is intended for personal use.

Microsoft Defender Application Guard – Key Features:

1. MDAG uses the Hyper-V hypervisor technology, a core component of Windows virtualization capabilities, to create a secure, isolated container for untrusted tasks. Any activity deemed suspicious or potentially harmful is executed within a virtual machine (VM) that is completely segregated from the host operating system. The isolated container is lightweight and optimized to ensure that browsing and application performance remains smooth and responsive.
2. It is tightly integrated with Microsoft Edge, the default web browser in Windows 10 and Windows 11. This integration extends to the handling of downloads and file executions.
3. By running untrusted sites and applications in an isolated container, MDAG prevents malware, ransomware, and other malicious software from spreading to the host system.
4. MDAG is designed to be compatible with existing enterprise infrastructure and security solutions. It integrates seamlessly with other Microsoft security products such as Microsoft Defender Antivirus and Microsoft Endpoint Manager, providing a comprehensive security ecosystem.

Deploying and managing MDAG is straightforward, thanks to its integration with Windows management tools and centralized policy controls.

Take away:

Microsoft Defender Application Guard in Windows 11 professional editions is a powerful and versatile security feature designed to protect enterprise environments from advanced cyber threats. By deploying MDAG, enterprises can safeguard their sensitive data, maintain high levels of performance and usability, and stay ahead of emerging threats. Stay tuned to winsides.com for more interesting articles. Safe Computing! Peace out!

Key Steps:

• Open Run Command.
• Execute the command msconfig in the Run command.
• Switch to Boot Tab in System Configuration.
• Enable Safe boot, choose Minimal or Alternate Shell, or Active Directory repair, or Network accordingly and Click Apply.

Why and When do I need the Safe Boot option in Windows 11?

Understanding why and when to use Safe Boot can significantly help maintain your system’s health and resolve problems efficiently.

Why?

• Safe Boot allows you to start Windows without third-party drivers and startup programs, helping you identify and fix problems that prevent Windows from starting normally.
• Some malware is designed to load automatically when Windows starts. Safe Boot prevents these malicious programs from launching, making it easier to remove them using antivirus or anti-malware tools.
• Conflicting or corrupt drivers can cause system instability or crashes. Safe Boot loads only essential drivers, allowing you to identify and update or uninstall problematic drivers without interference.
• Safe Boot provides a controlled environment for performing system maintenance tasks, such as running system file checks, disk checks, and restoring system settings using System Restore.
• If you encounter BSOD errors, Safe Boot can help you troubleshoot the underlying cause, whether it’s a driver issue, hardware failure, or software conflict.

When?

1. After Installing New Software or Drivers
2. Experiencing Frequent Crashes or Freezes
3. Suspected Malware Infection
4. System Performance Issues
5. Blue Screen of Death (BSOD) Errors

Let’s get into the steps.

• Open the Run command using the Start menu or using the shortcut Win Key + R.
• Enter the following command and click OK. msconfig

• System Configuration will open now.
• Switch to the tab “Boot“.

• Under Boot options, enable Safe Boot by clicking the checkbox next to it.

• Now, we have four options to choose from, Minimal, Alternate Shell, Active Directory repair, and Network.

Minimal Safe Boot option:

The basic set of drivers and services without network connectivity. Suitable for general troubleshooting.

Alternate Shell:

Command Prompt interface instead of the graphical user interface(GUI). Useful for advanced troubleshooting when the GUI is not accessible.

Active Directory Repair:

Loads services required to repair the Active Directory. Primarily used in enterprise environments.

Network:

The basic set of drivers and services with network connectivity. Useful for troubleshooting network-related issues.

• Choose your option accordingly, and finally, click Apply.

• You will be prompted to restart your computer. Click “Restart” to boot into Safe Mode in Windows 11.

Take away:

The Safe Boot option in Windows 11 is a crucial tool for diagnosing and resolving various system issues. By starting your computer with a minimal set of drivers and services, Safe Boot provides a clean environment that helps isolate and fix problems effectively. Happy Computing! Peace out!

How to use this tool in Windows 11?

MSRT is not a replacement for a full antivirus program. It only targets specific, prevalent malware and does not provide comprehensive protection. It is included in the automatic updates provided by Windows Update. It runs in the background and does not require user intervention. However, users can also use it manually using the following steps.

• Open Run Command using Win Key + R. Run the following command. mrt

• Malicious Software Removal Tool will open now.

• Click Next to continue with the process.

• There will be three options, Quick Scan, Full Scan, and Custom Scan. Choose your option accordingly. For explanation, I am proceeding with Quick Scan.

• The Tool will start the scan.

• The scanning process will take some time. Once it is completed, the scan will provide the results.
• Click View Detailed Results of the Scan to check the results.

• Detailed results will be displayed. If everything is clean, then you will find “Not Infected”. Click OK to close the window.

• Finally, click Finish to close the Malicious Software Removal Tool in Windows 11. That is it!

Microsoft quotes “This tool is not a replacement for an anti-virus product. To help protect your computer, you should use an anti-virus product”.

Take away:

The Microsoft Malicious Software Removal Tool in Windows 11 is a valuable utility for adding an extra layer of security to your Windows 11. By running regular scans and keeping your system updated, you can help protect your computer from specific prevalent malicious software. Safe Computing! Peace out!

• Go to Windows Settings using the keyboard Combination Win Key + I.
• Click on Privacy and Settings from the left pane.

• Under Security, click on Windows Security. Under Protection Areas, click on Virus & Threat Protection.

• Scroll down and locate Ransomware Protection. Click on Manage Ransomware Protection.

• Ransomware Protection will open now. There are two things(preventative and breakdown maintenance) to be done here. Controlled Folder Access, and Ransomware Data Recovery.
• Controlled Folder Access protects files, folders, and memory areas on your device from unauthorized changes by unfriendly applications. Ransomware Data Recovery may help users recover files in case of a ransomware attack by setting up OneDrive.
• Toggle the Controlled Folder Access switch to ON. User Account Control will prompt your permission. Click Yes.

• Click on Protected Folders now.

• This option allows users to add files and folders to protected folders. It is an essential process.

• The next thing is to set up the OneDrive Account.

• Set up your Microsoft Account. You can put your files in OneDrive to get them from any device.

• Once configured, you can share your files to your OneDrive Account, however, OneDrive provides 5 GB of free storage, and upon exceeding, one may have to opt for additional paid storage to continue storing new files on their OneDrive Account.
• That is it. Ransomware Protection is now configured in your Windows 11. Stay Protected and enjoy your Windows 11 Experience.

Why Ransomware Protection is Extremely Essential in Windows 11?

1. Ransomware attacks can lead to significant data loss if files are encrypted and the victim chooses not to pay the ransom. Having ransomware protection can help prevent such data loss by detecting and stopping ransomware attacks before they can encrypt files.
2. It often targets personal and sensitive information, including financial data, documents, and personal photos.
3. For businesses, ransomware attacks can disrupt operations, leading to downtime and financial losses.
4. Effective ransomware protection reduces the likelihood of needing to pay a ransom to regain access to files.

Enabling Ransomware Protection in Windows 11 provides users and organizations with peace of mind, knowing that their data is secure and protected against malicious attacks that aim to extort money through encryption.

Take away:

By implementing robust security practices, staying vigilant against phishing attempts, regularly updating software and backups, and leveraging Windows 11’s security capabilities, users can enhance their resilience against ransomware attacks and protect their valuable data from exploitation. Windows Security features also include Real-time protection, Tamper Protection, Dev Drive Protection, Cloud-delivered Protection, Core Isolation(Memory Integrity), and more. Make sure to enable these features in Windows 11, and stay safe. Happy Coding! Peace out!