Check Microsoft Defender status and run scans with PowerShell

Is protection actually on?

Get-MpComputerStatus reports whether real-time protection, behavior monitoring, and tamper protection are enabled, plus signature versions and their age. A machine with RealTimeProtectionEnabled False or signatures several days old is not protected, whatever the console says.

AMRunningMode shows Normal, Passive, or EDR Block Mode. Passive means another antivirus is primary and Defender is not blocking.

Snippet

Get-MpComputerStatus | Select AMRunningMode, RealTimeProtectionEnabled, BehaviorMonitorEnabled, IsTamperProtected, AntivirusSignatureAge, AntivirusSignatureLastUpdated

Look at exclusions

Get-MpPreference shows configuration, including ExclusionPath, ExclusionExtension, and ExclusionProcess. Broad exclusions such as C:\, C:\Users, or *.exe disable scanning where it matters. Attackers with admin rights sometimes add exclusions instead of disabling Defender, because it is quieter.

Defender logs configuration changes as Event 5007 in its Operational log, which makes exclusion changes detectable.

Snippet

Get-MpPreference | Select ExclusionPath, ExclusionExtension, ExclusionProcess, DisableRealtimeMonitoring, PUAProtection, CloudBlockLevel

Lab: update, scan, and test detection

Update signatures, run a quick scan, and list detection history. Then test detection safely with the EICAR test string, an industry-standard harmless file that every antivirus is designed to flag. Defender should quarantine it and record Event 1116 and 1117.

Remove the test entry from history afterward with Remove-MpThreat if needed.

Snippet

Update-MpSignature
Start-MpScan -ScanType QuickScan
Set-Content -Path $env:TEMP\eicar.txt -Value ('X5O!P%@AP[4\PZX54(P^)7CC)7}#x27; + 'EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*')
Get-MpThreatDetection | Select InitialDetectionTime, ThreatID, ActionSuccess, Resources
Get-WinEvent -LogName 'Microsoft-Windows-Windows Defender/Operational' -MaxEvents 10 | Format-Table TimeCreated, Id, Message -Wrap

At fleet scale

Collect Get-MpComputerStatus from all machines with your management tool and alert on any with real-time protection off, tamper protection off, or signatures older than two days.

Enable tamper protection so local administrators and malware cannot change key settings, and manage exclusions centrally with a review process.

Diagram

A Defender health check

Status
Real-time, behavior, tamper, signature age.
Command
```
Get-MpComputerStatus
```
Preferences
Review exclusions and cloud settings.
Test
Drop the EICAR string and confirm detection.
Fleet
Report unhealthy machines centrally.

Check yourself

1. Which cmdlet shows whether real-time protection is enabled?

2. Why might an attacker add an exclusion instead of disabling Defender?

3. What is the EICAR file?