Troubleshoot Microsoft Defender Antivirus scan issues

If you're seeing issues with Microsoft Defender Antivirus scans, such as scans aren't finishing, or scans are causing performance issues on devices, you might need to troubleshoot the scan process. This article describes how to identify information to address issues with Microsoft Defender Antivirus scans. You learn how scans are launched, what policies are applied to scans, why scans ended, and what's impacting the performance of a scan.

How scans are launched

Understanding why a scan is launched can help identify what settings are applied to the scan and what can be adjusted. In Microsoft Defender for Endpoint, antivirus scans can be launched in several ways. The following table summarizes these options:

CPU performance and scan throttling in Microsoft Defender Antivirus

Microsoft Defender Antivirus includes several configurable settings to manage CPU usage during scans. These settings help balance system performance and security by controlling how aggressively Defender uses system resources. If you use Group Policy, these settings are found under Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Scan. To check current value of these settings on a machine use the Get-MpPreference PowerShell command.

The key settings to be aware of are listed in the following table:

Policies that impact scanning

Understanding the policies applied to the scan enables you to understand the behavior of the scan and what can be tuned to remediate scan challenges.

The following table summarizes antivirus settings in Microsoft Intune for Windows devices:

In an Intune policy and in Defender for Endpoint Security Settings Management, you can configure two scanning schedules:

• A daily quick scan: You can configure the time a daily quick scan runs. Disabling or not configuring disables a daily quick scan.

  Setting: Schedule Quick Scan Time

• A Scheduled scan: You can configure when a scheduled scan runs, you can choose the type of scan and when it runs.

  Settings: Scan Parameter; Schedule Scan Day; and Schedule Scan Time

If you're using Group Policy to manage your devices, see Configure Microsoft Defender Antivirus with Group Policy

For information about troubleshooting antivirus settings, see Troubleshoot Microsoft Defender Antivirus settings

For more information about scan behaviors when Microsoft Defender Antivirus is in passive mode, see Microsoft Defender Antivirus compatibility with other security products

Frequently asked questions about scans

• Question: My quick scans are scheduled for Mondays but they're happening daily. Why is that?

  Answer: If you want the scheduled scans to be the only scans, set ScheduleQuickScanTime to 0.

• Question: Why are catch-up scans not running on my machine, even though DisableCatchupQuickScan is set to 0?

  Answer: Catch-up scans don't run when the device is running on battery.

• Question: Why are daily quick scans not running on my machine even though I have scheduled them?

  Answer: Check to see if daily quick scans are configured on the machine. If ScanParameters is set to 2, then the default scheduled scan type is Full Scan. If ScheduledQuickScanTime is set to 0, then daily quick scans aren't set.

• Question: Why is my full scan failing due to memory issues (memory consumption/exceeding constraints)?

  Answer: It's possible that there are a large number of cab/zip files on the machine. We recommend going through high size folders and either cleaning up or removing unused files, and/or implementing exclusions for specific cases (such as files under C:\Windows). See Recommended antivirus exclusions for Configuration Manager.

How to confirm scan status

Confirming if a scan has been canceled or finished successfully allows you to target devices that have failed scans. To find out what happened, you can use Event Viewer in Windows; reports, advanced hunting, and the Device page in the Microsoft Defender portal; or APIs.

Event Viewer

The following Event IDs are related to scan operations on a device.

• Event ID 1000 - An anti-malware scan started.
• Event ID 1001 - An anti-malware scan finished.
• Event ID 1002 - An anti-malware scan was stopped before it finished.

For more information, see Microsoft Defender Antivirus event IDs and error codes.

Event viewer can be access on the machine by the application or PowerShell. For more information, see Review logs in Event Viewer (in this article).

Reports in the Microsoft Defender portal

Reports are available that include current scan status. You can expand the view and export details. For more information, see Device health report.

Advanced hunting

You can also find information about scan completion and cancellation in advanced hunting. To get help with advanced hunting, see the following articles:

• Proactively hunt for threats with advanced hunting in Microsoft Defender
• Choose between guided and advanced modes to hunt in Microsoft Defender XDR
• Learn the advanced hunting query language

Device page in the Microsoft Defender portal

In the Microsoft Defender portal, you can view information about scans on the device page. For more information, see the following articles:

• Device health reports in Microsoft Defender for Endpoint
• Device inventory

APIs

Data about scan status can be exported by using the export health reporting API, as follows:

"quickScanResult": "Completed",
"quickScanError": "",
"quickScanTime": "2202-08-02T18:40:15.882Z",
"fullScanResult": "",
"fullScanError": "",
"fullScanTime": null,

For more information, see Export device antivirus health report.

Reasons why scans are canceled or terminated

Identifying why a scan was canceled enables you to identify what needs to be reviewed to enable scans to finish successfully. The following table lists reasons why scans didn't complete.

Use performance analyzer on the device

If, after following the guidance in this article, you haven't identified a misconfiguration issue on the device, you can use the New-MpPerformanceRecording command to generate a trace to identify problems on the device. This performance analyzer gives you the following information:

• Top paths that impact scan time
• Top files that impact scan time
• Top processes that impact scan time
• Top file extensions that impact scan time
• Combinations, like these:
  • Top files per extension
  • Top paths per extension
  • Top processes per path- Top scans per file
• Top scans per file per process

For more information, see Performance analyzer for Microsoft Defender Antivirus.

One outcome of this process might be identifying files or paths that you want to exclude from antivirus scans to improve performance. Make sure to review the following articles:

• Exclusions overview
• Contextual file and folder exclusions

Reviewing Event logs

Local event logs can be reviewed either using the Event Viewer application or by using PowerShell.

Review logs in Event Viewer

On Windows devices, Microsoft Defender Antivirus logs are located at Application and Service Logs > Microsoft > Windows > Windows Defender > Operational.

The following screenshot shows scan logs in Event Viewer:

Here's an example of Event 1000 in Event Viewer:

Review events using PowerShell

You can also access this information with PowerShell by using the Get-WinEvent cmdlet.

For example, to get all events, use this command:

Get-WinEvent -LogName 'Microsoft-Windows-Windows Defender/Operational'

To view scan events, use this command:

Get-WinEvent -LogName 'Microsoft-Windows-Windows Defender/Operational' | where id -eq '1000'

See also

• About scheduled quick or full Microsoft Defender Antivirus scans
• Exclusions overview