Schedule antivirus scans using Windows Management Instrumentation (WMI)

This article describes how to configure scheduled Microsoft Defender Antivirus scans using Windows Management Instrumentation (WMI). WMI is useful for administrators who manage scan schedules programmatically or in environments where Group Policy isn't available. You'll learn how to set scan timing, configure idle-only scans, schedule remediation, and define daily quick scan times. To learn more about scheduling scans and about scan types, see Configure scheduled quick or full Microsoft Defender Antivirus scans.

Prerequisites

Supported operating systems

WMI-based scan scheduling is supported on the following operating systems:

• Windows
• Windows Server

Use Windows Management Instrumentation (WMI) to schedule scans

MSFT_MpPreference is the WMI class used to configure Microsoft Defender Antivirus preferences. Use the Set method of the MSFT_MpPreference class for the following properties:

The following WMI properties control scan scheduling and behavior in the Defender configuration class:

ScanParameters
ScanScheduleDay
ScanScheduleTime
RandomizeScheduleTaskTimes

For more information and allowed parameters, see Windows Defender WMIv2 APIs

WMI for scheduling scans when an endpoint isn't in use

Use the Set method of the MSFT_MpPreference class for the following properties:

The following WMI property controls whether scans run only when the device is idle:

ScanOnlyIfIdleEnabled

For more information about APIs and allowed parameters, see Windows Defender WMIv2 APIs.

WMI for scheduling scans to complete remediation

Remediation is the follow-up action that Microsoft Defender Antivirus takes to address detected threats after a scan, such as quarantining or removing malicious files. You can schedule when remediation occurs by using the Set method of the MSFT_MpPreference class for the following properties:

The following WMI properties define the remediation schedule day and time:

RemediationScheduleDay
RemediationScheduleTime

For more information and allowed parameters, see Windows Defender WMIv2 APIs.

WMI for scheduling daily scans

Use the Set method of the MSFT_MpPreference class for the following properties:

Use this WMI property to specify the scheduled daily quick scan time:

ScanScheduleQuickScanTime

For more information and allowed parameters, see Windows Defender WMIv2 APIs.