HelpCache/MSFT_MpThreatCatalog.cdxml-help.xml
|
<?xml version="1.0" encoding="utf-8"?>
<helpItems xmlns="http://msh" schema="maml"> <!-- Updatable Help Version 5.0.2.0 --> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Add-MpPreference</command:name> <maml:description> <maml:para>Modifies settings for Windows Defender.</maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Add</command:verb> <command:noun>MpPreference</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Add-MpPreference cmdlet modifies settings for Windows Defender. Use this cmdlet to add exclusions for file name extensions, paths, and processes, and to add default actions for high, moderate, and low threats.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Add-MpPreference</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ExclusionExtension</maml:name> <maml:description> <maml:para>Specifies an array of file name extensions, such as obj or lib, to exclude from scheduled, custom, and real-time scanning. This cmdlet adds these file name extensions to the exclusions.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ExclusionPath</maml:name> <maml:description> <maml:para>Specifies an array of file paths to exclude from scheduled and real-time scanning. You can specify a folder to exclude all the files under the folder. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ExclusionProcess</maml:name> <maml:description> <maml:para>Specifies an array of processes, as paths to process images. This cmdlet excludes any files opened by the processes that you specify from scheduled and real-time scanning. Specifying this parameter excludes files opened by executable programs only. The cmdlet does not exclude the processes themselves. To exclude a process, specify it by using the ExclusionPath parameter. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>Force</maml:name> <maml:description> <maml:para>Forces the command to run without asking for user confirmation.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="infa"> <maml:name>InformationAction</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">SilentlyContinue</command:parameterValue> <command:parameterValue required="false" variableLength="false">Stop</command:parameterValue> <command:parameterValue required="false" variableLength="false">Continue</command:parameterValue> <command:parameterValue required="false" variableLength="false">Inquire</command:parameterValue> <command:parameterValue required="false" variableLength="false">Ignore</command:parameterValue> <command:parameterValue required="false" variableLength="false">Suspend</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="iv"> <maml:name>InformationVariable</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.String</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="tiddefaca"> <maml:name>ThreatIDDefaultAction_Actions</maml:name> <maml:description> <maml:para>Specifies an array of the actions to take for the IDs specified by using the ThreatIDDefaultAction_Ids parameter. The acceptable values for this parameter are: -- 1: Clean -- 2: Quarantine -- 3: Remove -- 4: Allow -- 8: UserDefined -- 9: NoAction -- 10: Block</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">ThreatAction[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="tiddefaci"> <maml:name>ThreatIDDefaultAction_Ids</maml:name> <maml:description> <maml:para>Specifies an array of threat IDs. This cmdlet adds the default action for the threat IDs that you specify.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">Int64[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ExclusionExtension</maml:name> <maml:description> <maml:para>Specifies an array of file name extensions, such as obj or lib, to exclude from scheduled, custom, and real-time scanning. This cmdlet adds these file name extensions to the exclusions.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ExclusionPath</maml:name> <maml:description> <maml:para>Specifies an array of file paths to exclude from scheduled and real-time scanning. You can specify a folder to exclude all the files under the folder. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ExclusionProcess</maml:name> <maml:description> <maml:para>Specifies an array of processes, as paths to process images. This cmdlet excludes any files opened by the processes that you specify from scheduled and real-time scanning. Specifying this parameter excludes files opened by executable programs only. The cmdlet does not exclude the processes themselves. To exclude a process, specify it by using the ExclusionPath parameter. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>Force</maml:name> <maml:description> <maml:para>Forces the command to run without asking for user confirmation.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="infa"> <maml:name>InformationAction</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.Management.Automation.ActionPreference</command:parameterValue> <dev:type> <maml:name>System.Management.Automation.ActionPreference</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="iv"> <maml:name>InformationVariable</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.String</command:parameterValue> <dev:type> <maml:name>System.String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="tiddefaca"> <maml:name>ThreatIDDefaultAction_Actions</maml:name> <maml:description> <maml:para>Specifies an array of the actions to take for the IDs specified by using the ThreatIDDefaultAction_Ids parameter. The acceptable values for this parameter are: -- 1: Clean -- 2: Quarantine -- 3: Remove -- 4: Allow -- 8: UserDefined -- 9: NoAction -- 10: Block</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">ThreatAction[]</command:parameterValue> <dev:type> <maml:name>ThreatAction[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="tiddefaci"> <maml:name>ThreatIDDefaultAction_Ids</maml:name> <maml:description> <maml:para>Specifies an array of threat IDs. This cmdlet adds the default action for the threat IDs that you specify.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">Int64[]</command:parameterValue> <dev:type> <maml:name>Int64[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Add a folder to the exclusion list</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\> Add-MpPreference -ExclusionPath "C:\Temp" </dev:code> <dev:remarks> <maml:para>This command adds the folder C:\Temp to the exclusion list. The command disables Windows Defender scheduled and real-time scanning for files in this folder.</maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkID=317463</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-MpPreference</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Remove-MpPreference</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Set-MpPreference</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-MpComputerStatus</command:name> <maml:description> <maml:para>Gets the status of antimalware software on the computer.</maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Get</command:verb> <command:noun>MpComputerStatus</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Get-MpComputerStatus cmdlet gets the status of antimalware software installed on the computer. </maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-MpComputerStatus</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="infa"> <maml:name>InformationAction</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">SilentlyContinue</command:parameterValue> <command:parameterValue required="false" variableLength="false">Stop</command:parameterValue> <command:parameterValue required="false" variableLength="false">Continue</command:parameterValue> <command:parameterValue required="false" variableLength="false">Inquire</command:parameterValue> <command:parameterValue required="false" variableLength="false">Ignore</command:parameterValue> <command:parameterValue required="false" variableLength="false">Suspend</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="iv"> <maml:name>InformationVariable</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.String</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="infa"> <maml:name>InformationAction</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.Management.Automation.ActionPreference</command:parameterValue> <dev:type> <maml:name>System.Management.Automation.ActionPreference</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="iv"> <maml:name>InformationVariable</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.String</command:parameterValue> <dev:type> <maml:name>System.String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Get the computer status</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\> Get-MpComputerStatus AMEngineVersion : 1.1.9700.0 AMProductVersion : 4.3.9463.0 AMServiceEnabled : True AMServiceVersion : 4.3.9463.0 AntispywareEnabled : True AntispywareSignatureAge : 0 AntispywareSignatureLastUpdated : 7/30/2013 3:01:45 AM AntispywareSignatureVersion : 1.155.1107.0 AntivirusEnabled : True AntivirusSignatureAge : 0 AntivirusSignatureLastUpdated : 7/30/2013 3:01:45 AM AntivirusSignatureVersion : 1.155.1107.0 BehaviorMonitorEnabled : True ComputerID : A69DA5B8-06B3-4A00-B2C1-D18ED66BAD40 ComputerState : 0 FullScanAge : 4294967295 FullScanEndTime : FullScanStartTime : IoavProtectionEnabled : True LastFullScanSource : 0 LastQuickScanSource : 2 NISEnabled : False NISEngineVersion : 2.1.9700.0 NISSignatureAge : 0 NISSignatureLastUpdated : 7/30/2013 1:30:46 PM NISSignatureVersion : 106.0.0.0 OnAccessProtectionEnabled : True QuickScanAge : 0 QuickScanEndTime : 7/30/2013 1:50:24 PM QuickScanStartTime : 7/30/2013 1:49:15 PM RealTimeProtectionEnabled : True RealTimeScanDirection : 0 </dev:code> <dev:remarks> <maml:para>This command gets the status of antimalware protection software installed on the computer.</maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkId=317464</maml:uri> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-MpPreference</command:name> <maml:description> <maml:para>Gets preferences for the Windows Defender scans and updates. </maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Get</command:verb> <command:noun>MpPreference</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Get-MpPreference cmdlet gets preferences for the Windows Defender scans and updates.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-MpPreference</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="infa"> <maml:name>InformationAction</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">SilentlyContinue</command:parameterValue> <command:parameterValue required="false" variableLength="false">Stop</command:parameterValue> <command:parameterValue required="false" variableLength="false">Continue</command:parameterValue> <command:parameterValue required="false" variableLength="false">Inquire</command:parameterValue> <command:parameterValue required="false" variableLength="false">Ignore</command:parameterValue> <command:parameterValue required="false" variableLength="false">Suspend</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="iv"> <maml:name>InformationVariable</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.String</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="infa"> <maml:name>InformationAction</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.Management.Automation.ActionPreference</command:parameterValue> <dev:type> <maml:name>System.Management.Automation.ActionPreference</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="iv"> <maml:name>InformationVariable</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.String</command:parameterValue> <dev:type> <maml:name>System.String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: View the scheduled scan day</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\> $Preferences = Get-MpPreference PS C:\> $Preferences.ScanScheduleDay </dev:code> <dev:remarks> <maml:para>The first command gets the preferences, and then stores them in the $Preferences variable. </maml:para> <maml:para>The second command uses standard dot syntax to display the ScanScheduleDay property of the object stored in the $Preferences variable. </maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkID=317465</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Add-MpPreference</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Remove-MpPreference</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Set-MpPreference</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-MpThreatCatalog</command:name> <maml:description> <maml:para>Gets known threats from the definitions catalog.</maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Get</command:verb> <command:noun>MpThreatCatalog</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Get-MpThreatCatalog cmdlet gets known threats from the Windows Defender definitions catalog. The definitions catalog contains references to all known threats that Windows Defender can identify. </maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-MpThreatCatalog</maml:name> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="infa"> <maml:name>InformationAction</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">SilentlyContinue</command:parameterValue> <command:parameterValue required="false" variableLength="false">Stop</command:parameterValue> <command:parameterValue required="false" variableLength="false">Continue</command:parameterValue> <command:parameterValue required="false" variableLength="false">Inquire</command:parameterValue> <command:parameterValue required="false" variableLength="false">Ignore</command:parameterValue> <command:parameterValue required="false" variableLength="false">Suspend</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="iv"> <maml:name>InformationVariable</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.String</command:parameterValue> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Get-MpThreatCatalog</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="infa"> <maml:name>InformationAction</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">SilentlyContinue</command:parameterValue> <command:parameterValue required="false" variableLength="false">Stop</command:parameterValue> <command:parameterValue required="false" variableLength="false">Continue</command:parameterValue> <command:parameterValue required="false" variableLength="false">Inquire</command:parameterValue> <command:parameterValue required="false" variableLength="false">Ignore</command:parameterValue> <command:parameterValue required="false" variableLength="false">Suspend</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="iv"> <maml:name>InformationVariable</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.String</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="ID"> <maml:name>ThreatID</maml:name> <maml:description> <maml:para>Specifies an array of threat IDs. This cmdlet gets the threats that you specify from the definitions catalog.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">Int64[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="infa"> <maml:name>InformationAction</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.Management.Automation.ActionPreference</command:parameterValue> <dev:type> <maml:name>System.Management.Automation.ActionPreference</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="iv"> <maml:name>InformationVariable</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.String</command:parameterValue> <dev:type> <maml:name>System.String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="ID"> <maml:name>ThreatID</maml:name> <maml:description> <maml:para>Specifies an array of threat IDs. This cmdlet gets the threats that you specify from the definitions catalog.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">Int64[]</command:parameterValue> <dev:type> <maml:name>Int64[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Get a known threat from the definitions catalog</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\> Get-MpThreatCatalog -ThreatID 1994 </dev:code> <dev:remarks> <maml:para>This command gets the known threat that has the ID 1994.</maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkId=317467</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-MpThreat</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Remove-MpThreat</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-MpThreatDetection</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-MpThreatDetection</command:name> <maml:description> <maml:para>Gets active and past malware threats that Windows Defender detected.</maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Get</command:verb> <command:noun>MpThreatDetection</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Get-MpThreatDetection cmdlet gets active and past malware threats that Windows Defender detected on the computer. If Windows Defender has detected the threat that you specify, this cmdlet returns a list that shows each time Windows Defender detected the threat. </maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-MpThreatDetection</maml:name> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="infa"> <maml:name>InformationAction</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">SilentlyContinue</command:parameterValue> <command:parameterValue required="false" variableLength="false">Stop</command:parameterValue> <command:parameterValue required="false" variableLength="false">Continue</command:parameterValue> <command:parameterValue required="false" variableLength="false">Inquire</command:parameterValue> <command:parameterValue required="false" variableLength="false">Ignore</command:parameterValue> <command:parameterValue required="false" variableLength="false">Suspend</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="iv"> <maml:name>InformationVariable</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.String[]</command:parameterValue> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Get-MpThreatDetection</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="infa"> <maml:name>InformationAction</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">SilentlyContinue</command:parameterValue> <command:parameterValue required="false" variableLength="false">Stop</command:parameterValue> <command:parameterValue required="false" variableLength="false">Continue</command:parameterValue> <command:parameterValue required="false" variableLength="false">Inquire</command:parameterValue> <command:parameterValue required="false" variableLength="false">Ignore</command:parameterValue> <command:parameterValue required="false" variableLength="false">Suspend</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="iv"> <maml:name>InformationVariable</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="ID"> <maml:name>ThreatID</maml:name> <maml:description> <maml:para>Specifies an array of threat IDs. This cmdlet gets the threats that you specify.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">Int64[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="infa"> <maml:name>InformationAction</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.Management.Automation.ActionPreference[]</command:parameterValue> <dev:type> <maml:name>System.Management.Automation.ActionPreference[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="iv"> <maml:name>InformationVariable</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.String[]</command:parameterValue> <dev:type> <maml:name>System.String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="ID"> <maml:name>ThreatID</maml:name> <maml:description> <maml:para>Specifies an array of threat IDs. This cmdlet gets the threats that you specify.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">Int64[]</command:parameterValue> <dev:type> <maml:name>Int64[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Get threats that Windows Defender detected</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\> Get-MpThreatDetection </dev:code> <dev:remarks> <maml:para>This command returns the list of past malware detections for the local computer. </maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkId=317468</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-MpThreat</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Remove-MpThreat</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-MpThreatCatalog</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Get-MpThreat</command:name> <maml:description> <maml:para>Gets the history of threats detected on the computer.</maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Get</command:verb> <command:noun>MpThreat</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Get-MpThreat cmdlet gets the history of threats that Windows Defender detected on the computer. </maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Get-MpThreat</maml:name> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="infa"> <maml:name>InformationAction</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">SilentlyContinue</command:parameterValue> <command:parameterValue required="false" variableLength="false">Stop</command:parameterValue> <command:parameterValue required="false" variableLength="false">Continue</command:parameterValue> <command:parameterValue required="false" variableLength="false">Inquire</command:parameterValue> <command:parameterValue required="false" variableLength="false">Ignore</command:parameterValue> <command:parameterValue required="false" variableLength="false">Suspend</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="iv"> <maml:name>InformationVariable</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.String</command:parameterValue> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Get-MpThreat</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="infa"> <maml:name>InformationAction</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">SilentlyContinue</command:parameterValue> <command:parameterValue required="false" variableLength="false">Stop</command:parameterValue> <command:parameterValue required="false" variableLength="false">Continue</command:parameterValue> <command:parameterValue required="false" variableLength="false">Inquire</command:parameterValue> <command:parameterValue required="false" variableLength="false">Ignore</command:parameterValue> <command:parameterValue required="false" variableLength="false">Suspend</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="iv"> <maml:name>InformationVariable</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.String</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="ID"> <maml:name>ThreatID</maml:name> <maml:description> <maml:para>Specifies an array of threat IDs. This cmdlet gets the history of the threats that you specify.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">Int64[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="infa"> <maml:name>InformationAction</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.Management.Automation.ActionPreference</command:parameterValue> <dev:type> <maml:name>System.Management.Automation.ActionPreference</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="iv"> <maml:name>InformationVariable</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.String</command:parameterValue> <dev:type> <maml:name>System.String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="ID"> <maml:name>ThreatID</maml:name> <maml:description> <maml:para>Specifies an array of threat IDs. This cmdlet gets the history of the threats that you specify.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">Int64[]</command:parameterValue> <dev:type> <maml:name>Int64[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Get the history of a detected threat</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\> Get-MpThreat -ThreatID 1994 </dev:code> <dev:remarks> <maml:para>This command gets the history of the threat on the local computer that has the ID 1994.</maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkId=317466</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Remove-MpThreat</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-MpThreatCatalog</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-MpThreatDetection</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Remove-MpPreference</command:name> <maml:description> <maml:para>Removes exclusions or default actions. </maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Remove</command:verb> <command:noun>MpPreference</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Remove-MpPreference cmdlet removes exclusions for file name extensions, paths, and processes, or default actions for high, moderate, and low threats. If you attempt to remove an exclusion that is not in the list, this cmdlet reports the error.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Remove-MpPreference</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ExclusionExtension</maml:name> <maml:description> <maml:para>Specifies an array of file name extensions, such as obj or lib, to exclude from scheduled, custom, and real-time scanning. This cmdlet removes the exclusions that you specify.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ExclusionPath</maml:name> <maml:description> <maml:para>Specifies an array of file paths to exclude from scheduled and real-time scanning. This cmdlet removes the exclusions that you specify.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ExclusionProcess</maml:name> <maml:description> <maml:para>Specifies an array of processes, as paths to process images. This cmdlet removes exclusions of files opened by the processes that you specify.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>Force</maml:name> <maml:description> <maml:para>Forces the command to run without asking for user confirmation.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="htdefac"> <maml:name>HighThreatDefaultAction</maml:name> <maml:description> <maml:para>Indicates that this cmdlet removes the automatic remediation action specified for the high threat alert level.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="infa"> <maml:name>InformationAction</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">SilentlyContinue</command:parameterValue> <command:parameterValue required="false" variableLength="false">Stop</command:parameterValue> <command:parameterValue required="false" variableLength="false">Continue</command:parameterValue> <command:parameterValue required="false" variableLength="false">Inquire</command:parameterValue> <command:parameterValue required="false" variableLength="false">Ignore</command:parameterValue> <command:parameterValue required="false" variableLength="false">Suspend</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="iv"> <maml:name>InformationVariable</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="ltdefac"> <maml:name>LowThreatDefaultAction</maml:name> <maml:description> <maml:para>Indicates that this cmdlet removes the automatic remediation action specified for the low threat alert level.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="mtdefac"> <maml:name>ModerateThreatDefaultAction</maml:name> <maml:description> <maml:para>Indicates that this cmdlet removes the automatic remediation action specified for the moderate threat alert level.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="stdefac"> <maml:name>SevereThreatDefaultAction</maml:name> <maml:description> <maml:para>Indicates that this cmdlet removes the automatic remediation action specified for the severe threat alert level.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="tiddefaci"> <maml:name>ThreatIDDefaultAction_Ids</maml:name> <maml:description> <maml:para>Specifies an array of threat IDs. This cmdlet removes the default actions for the threat IDs that you specify.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">Int64[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="unktdefac"> <maml:name>UnknownThreatDefaultAction</maml:name> <maml:description> <maml:para>Indicates that this cmdlet removes the automatic remediation action specified for the unknown threat alert level.</maml:para> </maml:description> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ExclusionExtension</maml:name> <maml:description> <maml:para>Specifies an array of file name extensions, such as obj or lib, to exclude from scheduled, custom, and real-time scanning. This cmdlet removes the exclusions that you specify.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ExclusionPath</maml:name> <maml:description> <maml:para>Specifies an array of file paths to exclude from scheduled and real-time scanning. This cmdlet removes the exclusions that you specify.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ExclusionProcess</maml:name> <maml:description> <maml:para>Specifies an array of processes, as paths to process images. This cmdlet removes exclusions of files opened by the processes that you specify.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>Force</maml:name> <maml:description> <maml:para>Forces the command to run without asking for user confirmation.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="htdefac"> <maml:name>HighThreatDefaultAction</maml:name> <maml:description> <maml:para>Indicates that this cmdlet removes the automatic remediation action specified for the high threat alert level.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="infa"> <maml:name>InformationAction</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.Management.Automation.ActionPreference[]</command:parameterValue> <dev:type> <maml:name>System.Management.Automation.ActionPreference[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="iv"> <maml:name>InformationVariable</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.String[]</command:parameterValue> <dev:type> <maml:name>System.String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="ltdefac"> <maml:name>LowThreatDefaultAction</maml:name> <maml:description> <maml:para>Indicates that this cmdlet removes the automatic remediation action specified for the low threat alert level.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="mtdefac"> <maml:name>ModerateThreatDefaultAction</maml:name> <maml:description> <maml:para>Indicates that this cmdlet removes the automatic remediation action specified for the moderate threat alert level.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="stdefac"> <maml:name>SevereThreatDefaultAction</maml:name> <maml:description> <maml:para>Indicates that this cmdlet removes the automatic remediation action specified for the severe threat alert level.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="tiddefaci"> <maml:name>ThreatIDDefaultAction_Ids</maml:name> <maml:description> <maml:para>Specifies an array of threat IDs. This cmdlet removes the default actions for the threat IDs that you specify.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">Int64[]</command:parameterValue> <dev:type> <maml:name>Int64[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="unktdefac"> <maml:name>UnknownThreatDefaultAction</maml:name> <maml:description> <maml:para>Indicates that this cmdlet removes the automatic remediation action specified for the unknown threat alert level.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Remove a folder from the exclusion list</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\> Remove-MpPreference -ExclusionPath "C:\Temp" </dev:code> <dev:remarks> <maml:para>This command removes the folder C:\Temp from the exclusion list. </maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkID=317469</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Add-MpPreference</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-MpPreference</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Set-MpPreference</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Remove-MpThreat</command:name> <maml:description> <maml:para>Removes active threats from a computer.</maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Remove</command:verb> <command:noun>MpThreat</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Remove-MpThreat cmdlet removes all active threats that Windows Defender detected on a computer. </maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Remove-MpThreat</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="infa"> <maml:name>InformationAction</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">SilentlyContinue</command:parameterValue> <command:parameterValue required="false" variableLength="false">Stop</command:parameterValue> <command:parameterValue required="false" variableLength="false">Continue</command:parameterValue> <command:parameterValue required="false" variableLength="false">Inquire</command:parameterValue> <command:parameterValue required="false" variableLength="false">Ignore</command:parameterValue> <command:parameterValue required="false" variableLength="false">Suspend</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="iv"> <maml:name>InformationVariable</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="infa"> <maml:name>InformationAction</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.Management.Automation.ActionPreference[]</command:parameterValue> <dev:type> <maml:name>System.Management.Automation.ActionPreference[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="iv"> <maml:name>InformationVariable</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.String[]</command:parameterValue> <dev:type> <maml:name>System.String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Remove active threats from a computer</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\> Remove-MpThreat </dev:code> <dev:remarks> <maml:para>This command removes all active threats from the local computer. </maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkId=317470</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-MpThreat</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-MpThreatCatalog</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-MpThreatDetection</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Set-MpPreference</command:name> <maml:description> <maml:para>Configures preferences for Windows Defender scans and updates.</maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Set</command:verb> <command:noun>MpPreference</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Set-MpPreference cmdlet configures preferences for Windows Defender scans and updates. You can modify exclusion file name extensions, paths, or processes, and specify the default action for high, moderate, and low threat levels.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Set-MpPreference</maml:name> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="csbr"> <maml:name>CheckForSignaturesBeforeRunningScan</maml:name> <maml:description> <maml:para>Indicates whether to check for new virus and spyware definitions before Windows Defender runs a scan. If you specify a value of $True, Windows Defender checks for new definitions. If you specify $False or do not specify a value, the scan begins with existing definitions. This value applies to scheduled scans and to scans that you start from the command line, but it does not affect scans that you start from the user interface.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="darchsc"> <maml:name>DisableArchiveScanning</maml:name> <maml:description> <maml:para>Indicates whether to scan archive files, such as .zip and .cab files, for malicious and unwanted software. If you specify a value of $True or do not specify a value, Windows Defender scans archive files.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="dae"> <maml:name>DisableAutoExclusions</maml:name> <maml:description> <maml:para>Indicates whether to disable the Automatic Exclusions feature for the server.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="dbm"> <maml:name>DisableBehaviorMonitoring</maml:name> <maml:description> <maml:para>Indicates whether to enable behavior monitoring. If you specify a value of $True or do not specify a value, Windows Defender enables behavior monitoring.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="dcfsc"> <maml:name>DisableCatchupFullScan</maml:name> <maml:description> <maml:para>Indicates whether Windows Defender runs catch-up scans for scheduled full scans. A computer can miss a scheduled scan, usually because the computer is turned off at the scheduled time. If you specify a value of $True, after the computer misses two scheduled full scans, Windows Defender runs a catch-up scan the next time someone logs on to the computer. If you specify a value of $False or do not specify a value, the computer does not run catch-up scans for scheduled full scans.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="dcqsc"> <maml:name>DisableCatchupQuickScan</maml:name> <maml:description> <maml:para>Indicates whether Windows Defender runs catch-up scans for scheduled quick scans. A computer can miss a scheduled scan, usually because the computer is off at the scheduled time. If you specify a value of $True, after the computer misses two scheduled quick scans, Windows Defender runs a catch-up scan the next time someone logs onto the computer. If you specify a value of $False or do not specify a value, the computer does not run catch-up scans for scheduled quick scans. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="demsc"> <maml:name>DisableEmailScanning</maml:name> <maml:description> <maml:para>Indicates whether Windows Defender parses the mailbox and mail files, according to their specific format, in order to analyze mail bodies and attachments. Windows Defender supports several formats, including .pst, .dbx, .mbx, .mime, and .binhex. If you specify a value of $True, Windows Defender performs email scanning. If you specify a value of $False or do not specify a value, Windows Defender does not perform email scanning. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="dips"> <maml:name>DisableIntrusionPreventionSystem</maml:name> <maml:description> <maml:para>Indicates whether to configure network protection against exploitation of known vulnerabilities. If you specify a value of $True or do not specify a value, network protection is enabled.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="dioavp"> <maml:name>DisableIOAVProtection</maml:name> <maml:description> <maml:para>Indicates whether Windows Defender scans all downloaded files and attachments. If you specify a value of $True or do not specify a value, scanning downloaded files and attachments is enabled. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="dpm"> <maml:name>DisablePrivacyMode</maml:name> <maml:description> <maml:para>Indicates whether to disable privacy mode. Privacy mode prevents users, other than administrators, from displaying threat history.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="drtm"> <maml:name>DisableRealtimeMonitoring</maml:name> <maml:description> <maml:para>Indicates whether to use real-time protection. If you specify a value of $True or do not specify a value, Windows Defender uses real-time protection. We recommend that you enable Windows Defender to use real-time protection.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="drdsc"> <maml:name>DisableRemovableDriveScanning</maml:name> <maml:description> <maml:para>Indicates whether to scan for malicious and unwanted software in removable drives, such as flash drives, during a full scan. If you specify a value of $True, Windows Defender scans removable drives during any type of scan. If you specify a value of $False or do not specify a value, Windows Defender does not scan removable drives during a full scan. Windows Defender can still scan removable drives during quick scans or custom scans.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="drp"> <maml:name>DisableRestorePoint</maml:name> <maml:description> <maml:para>Indicates whether to disable scanning of restore points.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="dsmndfsc"> <maml:name>DisableScanningMappedNetworkDrivesForFullScan</maml:name> <maml:description> <maml:para>Indicates whether to scan mapped network drives. If you specify a value of $True, Windows Defender scans mapped network drives. If you specify a value of $False or do not specify a value, Windows Defender does not scan mapped network drives.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="dsnf"> <maml:name>DisableScanningNetworkFiles</maml:name> <maml:description> <maml:para>Indicates whether to scan for network files. If you specify a value of $True, Windows Defender scans network files. If you specify a value of $False or do not specify a value, Windows Defender does not scan network files. We do not recommend that you scan network files. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="dscrptsc"> <maml:name>DisableScriptScanning</maml:name> <maml:description> <maml:para>Specifies whether to disable the scanning of scripts during malware scans.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ExclusionExtension</maml:name> <maml:description> <maml:para>Specifies an array of file name extensions, such as obj or lib, to exclude from scheduled, custom, and real-time scanning.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ExclusionPath</maml:name> <maml:description> <maml:para>Specifies an array of file paths to exclude from scheduled and real-time scanning. You can specify a folder to exclude all the files under the folder. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ExclusionProcess</maml:name> <maml:description> <maml:para>Specifies an array of processes, as paths to process images. This cmdlet excludes any files opened by the processes that you specify from scheduled and real-time scanning. Specifying this parameter excludes files opened by executable programs only. The cmdlet does not exclude the processes themselves. To exclude a process, specify it by using the ExclusionPath parameter. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>Force</maml:name> <maml:description> <maml:para>Forces the command to run without asking for user confirmation.</maml:para> </maml:description> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="htdefac"> <maml:name>HighThreatDefaultAction</maml:name> <maml:description> <maml:para>Specifies which automatic remediation action to take for a high level threat. The acceptable values for this parameter are: -- Quarantine -- Remove -- Ignore </maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">Clean</command:parameterValue> <command:parameterValue required="false" variableLength="false">Quarantine</command:parameterValue> <command:parameterValue required="false" variableLength="false">Remove</command:parameterValue> <command:parameterValue required="false" variableLength="false">Allow</command:parameterValue> <command:parameterValue required="false" variableLength="false">UserDefined</command:parameterValue> <command:parameterValue required="false" variableLength="false">NoAction</command:parameterValue> <command:parameterValue required="false" variableLength="false">Block</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="infa"> <maml:name>InformationAction</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">SilentlyContinue</command:parameterValue> <command:parameterValue required="false" variableLength="false">Stop</command:parameterValue> <command:parameterValue required="false" variableLength="false">Continue</command:parameterValue> <command:parameterValue required="false" variableLength="false">Inquire</command:parameterValue> <command:parameterValue required="false" variableLength="false">Ignore</command:parameterValue> <command:parameterValue required="false" variableLength="false">Suspend</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="iv"> <maml:name>InformationVariable</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.String</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="ltdefac"> <maml:name>LowThreatDefaultAction</maml:name> <maml:description> <maml:para>Specifies which automatic remediation action to take for a low level threat. The acceptable values for this parameter are: -- Quarantine -- Remove -- Ignore </maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">Clean</command:parameterValue> <command:parameterValue required="false" variableLength="false">Quarantine</command:parameterValue> <command:parameterValue required="false" variableLength="false">Remove</command:parameterValue> <command:parameterValue required="false" variableLength="false">Allow</command:parameterValue> <command:parameterValue required="false" variableLength="false">UserDefined</command:parameterValue> <command:parameterValue required="false" variableLength="false">NoAction</command:parameterValue> <command:parameterValue required="false" variableLength="false">Block</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>MAPSReporting</maml:name> <maml:description> <maml:para>Specifies the type of membership in Microsoft Active Protection Service. Microsoft Active Protection Service is an online community that helps you choose how to respond to potential threats. The community also helps prevent the spread of new malicious software. The acceptable values for this parameter are: -- 0: Disabled. Send no information to Microsoft. This is the default value. -- 1: Basic membership. Send basic information to Microsoft about detected software, including where the software came from, the actions that you apply or that apply automatically, and whether the actions succeeded. -- 2: Advanced membership. In addition to basic information, send more information to Microsoft about malicious software, spyware, and potentially unwanted software, including the location of the software, file names, how the software operates, and how it affects your computer. </maml:para> <maml:para>If you join this community, you can choose to automatically send basic or additional information about detected software. Additional information helps Microsoft create new definitions. In some instances, personal information might unintentionally be sent to Microsoft. However, Microsoft will not use this information to identify you or contact you. </maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">Disabled</command:parameterValue> <command:parameterValue required="false" variableLength="false">Basic</command:parameterValue> <command:parameterValue required="false" variableLength="false">Advanced</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="mtdefac"> <maml:name>ModerateThreatDefaultAction</maml:name> <maml:description> <maml:para>Specifies which automatic remediation action to take for a moderate level threat. The acceptable values for this parameter are: -- Quarantine -- Remove -- Ignore </maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">Clean</command:parameterValue> <command:parameterValue required="false" variableLength="false">Quarantine</command:parameterValue> <command:parameterValue required="false" variableLength="false">Remove</command:parameterValue> <command:parameterValue required="false" variableLength="false">Allow</command:parameterValue> <command:parameterValue required="false" variableLength="false">UserDefined</command:parameterValue> <command:parameterValue required="false" variableLength="false">NoAction</command:parameterValue> <command:parameterValue required="false" variableLength="false">Block</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="qpiad"> <maml:name>QuarantinePurgeItemsAfterDelay</maml:name> <maml:description> <maml:para>Specifies the number of days to keep items in the Quarantine folder. If you specify a value of zero or do not specify a value for this parameter, items stay in the Quarantine folder indefinitely.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="rstt"> <maml:name>RandomizeScheduleTaskTimes</maml:name> <maml:description> <maml:para>Indicates whether to select a random time for the scheduled start and scheduled update for definitions. If you specify a value of $True or do not specify a value, scheduled tasks begin within 30 minutes, before or after, the scheduled time. If you randomize the start times, it can distribute the impact of scanning. For example, if several virtual machines share the same host, randomized start times prevents all the hosts from starting the scheduled tasks at the same time.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="rtsd"> <maml:name>RealTimeScanDirection</maml:name> <maml:description> <maml:para>Specifies scanning configuration for incoming and outgoing files on NTFS volumes. The acceptable values for this parameter are: -- 0: Scan both incoming and outgoing files. This is the default. -- 1: Scan incoming files only. -- 2: Scan outgoing files only. Specify a value for this parameter to enhance performance on servers which have a large number of file transfers, but need scanning for either incoming or outgoing files. Evaluate this configuration based on the server role. For non-NTFS volumes, Windows Defender performs full monitoring of file and program activity.</maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">Both</command:parameterValue> <command:parameterValue required="false" variableLength="false">Incoming</command:parameterValue> <command:parameterValue required="false" variableLength="false">Outcoming</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="rsd"> <maml:name>RemediationScheduleDay</maml:name> <maml:description> <maml:para>Specifies the day of the week on which to perform a scheduled full scan in order to complete remediation. Alternatively, specify everyday for this full scan or never. The acceptable values for this parameter are: -- 0: Everyday -- 1: Sunday -- 2: Monday -- 3: Tuesday -- 4: Wednesday -- 5: Thursday -- 6: Friday -- 7: Saturday -- 8: Never The default value is 8, never. If you specify a value of 8 or do not specify a value, Windows Defender performs a scheduled full scan to complete remediation by using a default frequency.</maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">Everyday</command:parameterValue> <command:parameterValue required="false" variableLength="false">Sunday</command:parameterValue> <command:parameterValue required="false" variableLength="false">Monday</command:parameterValue> <command:parameterValue required="false" variableLength="false">Tuesday</command:parameterValue> <command:parameterValue required="false" variableLength="false">Wednesday</command:parameterValue> <command:parameterValue required="false" variableLength="false">Thursday</command:parameterValue> <command:parameterValue required="false" variableLength="false">Friday</command:parameterValue> <command:parameterValue required="false" variableLength="false">Saturday</command:parameterValue> <command:parameterValue required="false" variableLength="false">Never</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="rst"> <maml:name>RemediationScheduleTime</maml:name> <maml:description> <maml:para>Specifies the time of day, as the number of minutes after midnight, to perform a scheduled scan. The time refers to the local time on the computer. If you do not specify a value for this parameter, a scheduled scan runs at the default time of two hours after midnight.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">DateTime</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="raat"> <maml:name>ReportingAdditionalActionTimeOut</maml:name> <maml:description> <maml:para>Specifies the number of minutes before a detection in the additional action state changes to the cleared state.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="rcto"> <maml:name>ReportingCriticalFailureTimeOut</maml:name> <maml:description> <maml:para>Specifies the number of minutes before a detection in the critically failed state changes to either the additional action state or the cleared state.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="rncto"> <maml:name>ReportingNonCriticalTimeOut</maml:name> <maml:description> <maml:para>Specifies the number of minutes before a detection in the non-critically failed state changes to the cleared state.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="saclf"> <maml:name>ScanAvgCPULoadFactor</maml:name> <maml:description> <maml:para>Specifies the maximum percentage CPU usage for a scan. The acceptable values for this parameter are: integers from 5 through 100, and the value 0, which disables CPU throttling. Windows Defender does not exceed the percentage of CPU usage that you specify. The default value is 50.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Byte</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="soiie"> <maml:name>ScanOnlyIfIdleEnabled</maml:name> <maml:description> <maml:para>Indicates whether to start scheduled scans only when the computer is not in use. If you specify a value of $True or do not specify a value, Windows Defender runs schedules scans when the computer is on, but not in use. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ScanParameters</maml:name> <maml:description> <maml:para>Specifies the scan type to use during a scheduled scan. The acceptable values for this parameter are: -- 1: Quick scan -- 2: Full scan If you do not specify this parameter, Windows Defender uses the default value of quick scan.</maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">QuickScan</command:parameterValue> <command:parameterValue required="false" variableLength="false">FullScan</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="spiad"> <maml:name>ScanPurgeItemsAfterDelay</maml:name> <maml:description> <maml:para>Specifies the number of days to keep items in the scan history folder. After this time, Windows Defender removes the items. If you specify a value of zero, Windows Defender does not remove items. If you do not specify a value, Windows Defender removes items from the scan history folder after the default length of time, which is 30 days. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="scsd"> <maml:name>ScanScheduleDay</maml:name> <maml:description> <maml:para>Specifies the day of the week on which to perform a scheduled scan. Alternatively, specify everyday for a scheduled scan or never. The acceptable values for this parameter are: -- 0: Everyday -- 1: Sunday -- 2: Monday -- 3: Tuesday -- 4: Wednesday -- 5: Thursday -- 6: Friday -- 7: Saturday -- 8: Never The default value is 8, never. If you specify a value of 8 or do not specify a value, Windows Defender does not perform scheduled scans.</maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">Everyday</command:parameterValue> <command:parameterValue required="false" variableLength="false">Sunday</command:parameterValue> <command:parameterValue required="false" variableLength="false">Monday</command:parameterValue> <command:parameterValue required="false" variableLength="false">Tuesday</command:parameterValue> <command:parameterValue required="false" variableLength="false">Wednesday</command:parameterValue> <command:parameterValue required="false" variableLength="false">Thursday</command:parameterValue> <command:parameterValue required="false" variableLength="false">Friday</command:parameterValue> <command:parameterValue required="false" variableLength="false">Saturday</command:parameterValue> <command:parameterValue required="false" variableLength="false">Never</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="scsqst"> <maml:name>ScanScheduleQuickScanTime</maml:name> <maml:description> <maml:para>Specifies the time of day, as the number of minutes after midnight, to perform a scheduled quick scan. The time refers to the local time on the computer. If you do not specify a value for this parameter, a scheduled quick scan runs at the time specified by the ScanScheduleTime parameter. That parameter has a default time of two hours after midnight. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">DateTime</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="scst"> <maml:name>ScanScheduleTime</maml:name> <maml:description> <maml:para>Specifies the time of day, as the number of minutes after midnight, to perform a scheduled scan. The time refers to the local time on the computer. If you do not specify a value for this parameter, a scheduled scan runs at a default time of two hours after midnight. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">DateTime</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="stdefac"> <maml:name>SevereThreatDefaultAction</maml:name> <maml:description> <maml:para>Specifies which automatic remediation action to take for a severe level threat. The acceptable values for this parameter are: -- Quarantine -- Remove -- Ignore </maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">Clean</command:parameterValue> <command:parameterValue required="false" variableLength="false">Quarantine</command:parameterValue> <command:parameterValue required="false" variableLength="false">Remove</command:parameterValue> <command:parameterValue required="false" variableLength="false">Allow</command:parameterValue> <command:parameterValue required="false" variableLength="false">UserDefined</command:parameterValue> <command:parameterValue required="false" variableLength="false">NoAction</command:parameterValue> <command:parameterValue required="false" variableLength="false">Block</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="sigagp"> <maml:name>SignatureAuGracePeriod</maml:name> <maml:description> <maml:para>Specifies a grace period, in minutes, for the definition. If a definition successfully updates within this period, Windows Defender abandons any service initiated updates.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="sigdufss"> <maml:name>SignatureDefinitionUpdateFileSharesSources</maml:name> <maml:description> <maml:para>Specifies file-share sources for definition updates. Specify sources as a bracketed sequence of Universal Naming Convention (UNC) locations, separated by the pipeline symbol; for example, { \\Server01\Share01 | \\Server02\Share02 | \\Server03\Share03}. If you specify a value for this parameter, Windows Defender attempts to connect to the shares in the order that you specify. After Windows Defender updates a definition, it stops attempting to connect to shares on the list. If you do not specify a value for this parameter, the list is empty.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">String</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="sigduoswo"> <maml:name>SignatureDisableUpdateOnStartupWithoutEngine</maml:name> <maml:description> <maml:para>Indicates whether to initiate definition updates even if no antimalware engine is present. If you specify a value of $True or do not specify a value, Windows Defender initiates definition updates on startup. If you specify a value of $False, and if no antimalware engine is present, Windows Defender does not initiate definition updates on startup.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="sfo"> <maml:name>SignatureFallbackOrder</maml:name> <maml:description> <maml:para>Specifies the order in which to contact different definition update sources. Specify the types of update sources in the order in which you want Windows Defender to contact them, enclosed in braces and separated by the pipeline symbol; for example, { InternalDefinitionUpdateServer | MicrosoftUpdateServer | MMPC }. The values that you can specify in the string are: -- InternalDefinitionUpdateServer -- MicrosoftUpdateServer -- MMPC -- FileShares MMPC refers to Microsoft Malware Protection Center. </maml:para> <maml:para>If you specify a value for this parameter, Windows Defender contacts the definition update sources in the specified order. After Windows Defender downloads definition updates from a source, it stops attempting to connect to other sources. If you do not specify a value for this parameter, Windows Defender contacts sources in the default order of { MicrosoftUpdateServer | MMPC }.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">String</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="sigfagp"> <maml:name>SignatureFirstAuGracePeriod</maml:name> <maml:description> <maml:para>Specifies a grace period, in minutes, for the definition. If a definition successfully updates within this period, Windows Defender abandons any service initiated updates. This parameter overrides the value of the CheckForSignaturesBeforeRunningScan parameter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="sigsd"> <maml:name>SignatureScheduleDay</maml:name> <maml:description> <maml:para>Specifies the day of the week on which to check for definition updates. Alternatively, specify everyday for a scheduled scan or never. The acceptable values for this parameter are: -- 0: Everyday -- 1: Sunday -- 2: Monday -- 3: Tuesday -- 4: Wednesday -- 5: Thursday -- 6: Friday -- 7: Saturday -- 8: Never The default value is 8, never. If you specify a value of 8 or do not specify a value, Windows Defender checks for definition updates by using a default frequency.</maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">Everyday</command:parameterValue> <command:parameterValue required="false" variableLength="false">Sunday</command:parameterValue> <command:parameterValue required="false" variableLength="false">Monday</command:parameterValue> <command:parameterValue required="false" variableLength="false">Tuesday</command:parameterValue> <command:parameterValue required="false" variableLength="false">Wednesday</command:parameterValue> <command:parameterValue required="false" variableLength="false">Thursday</command:parameterValue> <command:parameterValue required="false" variableLength="false">Friday</command:parameterValue> <command:parameterValue required="false" variableLength="false">Saturday</command:parameterValue> <command:parameterValue required="false" variableLength="false">Never</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="sigst"> <maml:name>SignatureScheduleTime</maml:name> <maml:description> <maml:para>Specifies the time of day, as the number of minutes after midnight, to check for definition updates. The time refers to the local time on the computer. If you do not specify a value for this parameter, Windows Defender checks for definition updates at the default time of 15 minutes before the scheduled scan time. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">DateTime</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="siguci"> <maml:name>SignatureUpdateCatchupInterval</maml:name> <maml:description> <maml:para>Specifies the number of days after which Windows Defender requires a catch-up definition update. If you do not specify a value for this parameter, Windows Defender requires a catch-up definition update after the default value of one day.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="sigui"> <maml:name>SignatureUpdateInterval</maml:name> <maml:description> <maml:para>Specifies the interval, in hours, at which to check for definition updates. The acceptable values for this parameter are: integers from 1 through 24. If you do not specify a value for this parameter, Windows Defender checks at the default interval. You can use this parameter instead of the SignatureScheduleDay parameter and SignatureScheduleTime parameter. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>SubmitSamplesConsent</maml:name> <maml:description> <maml:para>Specifies how Windows Defender checks for user consent for certain samples. If consent has previously been granted, Windows Defender submits the samples. Otherwise, if the MAPSReporting parameter does not have a value of Disabled, Windows Defender prompts the user for consent. The acceptable values for this parameter are: --0: Always prompt --1: Send safe samples automatically --2: Never send --3: Send all samples automatically</maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">None</command:parameterValue> <command:parameterValue required="false" variableLength="false">Always</command:parameterValue> <command:parameterValue required="false" variableLength="false">Never</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="tiddefaca"> <maml:name>ThreatIDDefaultAction_Actions</maml:name> <maml:description> <maml:para>Specifies an array of the actions to take for the IDs specified by using the ThreatIDDefaultAction_Ids parameter. The acceptable values for this parameter are: -- 1: Clean -- 2: Quarantine -- 3: Remove -- 4: Allow -- 8: UserDefined -- 9: NoAction -- 10: Block</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">ThreatAction[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="tiddefaci"> <maml:name>ThreatIDDefaultAction_Ids</maml:name> <maml:description> <maml:para>Specifies an array of threat IDs. This cmdlet modifies the default action for the threat IDs that you specify.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">Int64[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>UILockdown</maml:name> <maml:description> <maml:para>Indicates whether to disable UI lockdown mode. If you specify a value of $True, Windows Defender disables UI lockdown mode. If you specify $False or do not specify a value, UI lockdown mode is enabled.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="unktdefac"> <maml:name>UnknownThreatDefaultAction</maml:name> <maml:description> <maml:para>Specifies which automatic remediation action to take for an unknown level threat. The acceptable values for this parameter are: -- Quarantine -- Remove -- Ignore </maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">Clean</command:parameterValue> <command:parameterValue required="false" variableLength="false">Quarantine</command:parameterValue> <command:parameterValue required="false" variableLength="false">Remove</command:parameterValue> <command:parameterValue required="false" variableLength="false">Allow</command:parameterValue> <command:parameterValue required="false" variableLength="false">UserDefined</command:parameterValue> <command:parameterValue required="false" variableLength="false">NoAction</command:parameterValue> <command:parameterValue required="false" variableLength="false">Block</command:parameterValue> </command:parameterValueGroup> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="csbr"> <maml:name>CheckForSignaturesBeforeRunningScan</maml:name> <maml:description> <maml:para>Indicates whether to check for new virus and spyware definitions before Windows Defender runs a scan. If you specify a value of $True, Windows Defender checks for new definitions. If you specify $False or do not specify a value, the scan begins with existing definitions. This value applies to scheduled scans and to scans that you start from the command line, but it does not affect scans that you start from the user interface.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> <dev:type> <maml:name>Boolean</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="darchsc"> <maml:name>DisableArchiveScanning</maml:name> <maml:description> <maml:para>Indicates whether to scan archive files, such as .zip and .cab files, for malicious and unwanted software. If you specify a value of $True or do not specify a value, Windows Defender scans archive files.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> <dev:type> <maml:name>Boolean</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="dae"> <maml:name>DisableAutoExclusions</maml:name> <maml:description> <maml:para>Indicates whether to disable the Automatic Exclusions feature for the server.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> <dev:type> <maml:name>Boolean</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="dbm"> <maml:name>DisableBehaviorMonitoring</maml:name> <maml:description> <maml:para>Indicates whether to enable behavior monitoring. If you specify a value of $True or do not specify a value, Windows Defender enables behavior monitoring.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> <dev:type> <maml:name>Boolean</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="dcfsc"> <maml:name>DisableCatchupFullScan</maml:name> <maml:description> <maml:para>Indicates whether Windows Defender runs catch-up scans for scheduled full scans. A computer can miss a scheduled scan, usually because the computer is turned off at the scheduled time. If you specify a value of $True, after the computer misses two scheduled full scans, Windows Defender runs a catch-up scan the next time someone logs on to the computer. If you specify a value of $False or do not specify a value, the computer does not run catch-up scans for scheduled full scans.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> <dev:type> <maml:name>Boolean</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="dcqsc"> <maml:name>DisableCatchupQuickScan</maml:name> <maml:description> <maml:para>Indicates whether Windows Defender runs catch-up scans for scheduled quick scans. A computer can miss a scheduled scan, usually because the computer is off at the scheduled time. If you specify a value of $True, after the computer misses two scheduled quick scans, Windows Defender runs a catch-up scan the next time someone logs onto the computer. If you specify a value of $False or do not specify a value, the computer does not run catch-up scans for scheduled quick scans. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> <dev:type> <maml:name>Boolean</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="demsc"> <maml:name>DisableEmailScanning</maml:name> <maml:description> <maml:para>Indicates whether Windows Defender parses the mailbox and mail files, according to their specific format, in order to analyze mail bodies and attachments. Windows Defender supports several formats, including .pst, .dbx, .mbx, .mime, and .binhex. If you specify a value of $True, Windows Defender performs email scanning. If you specify a value of $False or do not specify a value, Windows Defender does not perform email scanning. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> <dev:type> <maml:name>Boolean</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="dips"> <maml:name>DisableIntrusionPreventionSystem</maml:name> <maml:description> <maml:para>Indicates whether to configure network protection against exploitation of known vulnerabilities. If you specify a value of $True or do not specify a value, network protection is enabled.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> <dev:type> <maml:name>Boolean</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="dioavp"> <maml:name>DisableIOAVProtection</maml:name> <maml:description> <maml:para>Indicates whether Windows Defender scans all downloaded files and attachments. If you specify a value of $True or do not specify a value, scanning downloaded files and attachments is enabled. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> <dev:type> <maml:name>Boolean</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="dpm"> <maml:name>DisablePrivacyMode</maml:name> <maml:description> <maml:para>Indicates whether to disable privacy mode. Privacy mode prevents users, other than administrators, from displaying threat history.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> <dev:type> <maml:name>Boolean</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="drtm"> <maml:name>DisableRealtimeMonitoring</maml:name> <maml:description> <maml:para>Indicates whether to use real-time protection. If you specify a value of $True or do not specify a value, Windows Defender uses real-time protection. We recommend that you enable Windows Defender to use real-time protection.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> <dev:type> <maml:name>Boolean</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="drdsc"> <maml:name>DisableRemovableDriveScanning</maml:name> <maml:description> <maml:para>Indicates whether to scan for malicious and unwanted software in removable drives, such as flash drives, during a full scan. If you specify a value of $True, Windows Defender scans removable drives during any type of scan. If you specify a value of $False or do not specify a value, Windows Defender does not scan removable drives during a full scan. Windows Defender can still scan removable drives during quick scans or custom scans.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> <dev:type> <maml:name>Boolean</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="drp"> <maml:name>DisableRestorePoint</maml:name> <maml:description> <maml:para>Indicates whether to disable scanning of restore points.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> <dev:type> <maml:name>Boolean</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="dsmndfsc"> <maml:name>DisableScanningMappedNetworkDrivesForFullScan</maml:name> <maml:description> <maml:para>Indicates whether to scan mapped network drives. If you specify a value of $True, Windows Defender scans mapped network drives. If you specify a value of $False or do not specify a value, Windows Defender does not scan mapped network drives.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> <dev:type> <maml:name>Boolean</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="dsnf"> <maml:name>DisableScanningNetworkFiles</maml:name> <maml:description> <maml:para>Indicates whether to scan for network files. If you specify a value of $True, Windows Defender scans network files. If you specify a value of $False or do not specify a value, Windows Defender does not scan network files. We do not recommend that you scan network files. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> <dev:type> <maml:name>Boolean</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="dscrptsc"> <maml:name>DisableScriptScanning</maml:name> <maml:description> <maml:para>Specifies whether to disable the scanning of scripts during malware scans.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> <dev:type> <maml:name>Boolean</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ExclusionExtension</maml:name> <maml:description> <maml:para>Specifies an array of file name extensions, such as obj or lib, to exclude from scheduled, custom, and real-time scanning.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ExclusionPath</maml:name> <maml:description> <maml:para>Specifies an array of file paths to exclude from scheduled and real-time scanning. You can specify a folder to exclude all the files under the folder. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ExclusionProcess</maml:name> <maml:description> <maml:para>Specifies an array of processes, as paths to process images. This cmdlet excludes any files opened by the processes that you specify from scheduled and real-time scanning. Specifying this parameter excludes files opened by executable programs only. The cmdlet does not exclude the processes themselves. To exclude a process, specify it by using the ExclusionPath parameter. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>Force</maml:name> <maml:description> <maml:para>Forces the command to run without asking for user confirmation.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="htdefac"> <maml:name>HighThreatDefaultAction</maml:name> <maml:description> <maml:para>Specifies which automatic remediation action to take for a high level threat. The acceptable values for this parameter are: -- Quarantine -- Remove -- Ignore </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">ThreatAction</command:parameterValue> <dev:type> <maml:name>ThreatAction</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="infa"> <maml:name>InformationAction</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.Management.Automation.ActionPreference</command:parameterValue> <dev:type> <maml:name>System.Management.Automation.ActionPreference</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="iv"> <maml:name>InformationVariable</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.String</command:parameterValue> <dev:type> <maml:name>System.String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="ltdefac"> <maml:name>LowThreatDefaultAction</maml:name> <maml:description> <maml:para>Specifies which automatic remediation action to take for a low level threat. The acceptable values for this parameter are: -- Quarantine -- Remove -- Ignore </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">ThreatAction</command:parameterValue> <dev:type> <maml:name>ThreatAction</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>MAPSReporting</maml:name> <maml:description> <maml:para>Specifies the type of membership in Microsoft Active Protection Service. Microsoft Active Protection Service is an online community that helps you choose how to respond to potential threats. The community also helps prevent the spread of new malicious software. The acceptable values for this parameter are: -- 0: Disabled. Send no information to Microsoft. This is the default value. -- 1: Basic membership. Send basic information to Microsoft about detected software, including where the software came from, the actions that you apply or that apply automatically, and whether the actions succeeded. -- 2: Advanced membership. In addition to basic information, send more information to Microsoft about malicious software, spyware, and potentially unwanted software, including the location of the software, file names, how the software operates, and how it affects your computer. </maml:para> <maml:para>If you join this community, you can choose to automatically send basic or additional information about detected software. Additional information helps Microsoft create new definitions. In some instances, personal information might unintentionally be sent to Microsoft. However, Microsoft will not use this information to identify you or contact you. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">MAPSReportingType</command:parameterValue> <dev:type> <maml:name>MAPSReportingType</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="mtdefac"> <maml:name>ModerateThreatDefaultAction</maml:name> <maml:description> <maml:para>Specifies which automatic remediation action to take for a moderate level threat. The acceptable values for this parameter are: -- Quarantine -- Remove -- Ignore </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">ThreatAction</command:parameterValue> <dev:type> <maml:name>ThreatAction</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="qpiad"> <maml:name>QuarantinePurgeItemsAfterDelay</maml:name> <maml:description> <maml:para>Specifies the number of days to keep items in the Quarantine folder. If you specify a value of zero or do not specify a value for this parameter, items stay in the Quarantine folder indefinitely.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> <dev:type> <maml:name>UInt32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="rstt"> <maml:name>RandomizeScheduleTaskTimes</maml:name> <maml:description> <maml:para>Indicates whether to select a random time for the scheduled start and scheduled update for definitions. If you specify a value of $True or do not specify a value, scheduled tasks begin within 30 minutes, before or after, the scheduled time. If you randomize the start times, it can distribute the impact of scanning. For example, if several virtual machines share the same host, randomized start times prevents all the hosts from starting the scheduled tasks at the same time.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> <dev:type> <maml:name>Boolean</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="rtsd"> <maml:name>RealTimeScanDirection</maml:name> <maml:description> <maml:para>Specifies scanning configuration for incoming and outgoing files on NTFS volumes. The acceptable values for this parameter are: -- 0: Scan both incoming and outgoing files. This is the default. -- 1: Scan incoming files only. -- 2: Scan outgoing files only. Specify a value for this parameter to enhance performance on servers which have a large number of file transfers, but need scanning for either incoming or outgoing files. Evaluate this configuration based on the server role. For non-NTFS volumes, Windows Defender performs full monitoring of file and program activity.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">ScanDirection</command:parameterValue> <dev:type> <maml:name>ScanDirection</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="rsd"> <maml:name>RemediationScheduleDay</maml:name> <maml:description> <maml:para>Specifies the day of the week on which to perform a scheduled full scan in order to complete remediation. Alternatively, specify everyday for this full scan or never. The acceptable values for this parameter are: -- 0: Everyday -- 1: Sunday -- 2: Monday -- 3: Tuesday -- 4: Wednesday -- 5: Thursday -- 6: Friday -- 7: Saturday -- 8: Never The default value is 8, never. If you specify a value of 8 or do not specify a value, Windows Defender performs a scheduled full scan to complete remediation by using a default frequency.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Day</command:parameterValue> <dev:type> <maml:name>Day</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="rst"> <maml:name>RemediationScheduleTime</maml:name> <maml:description> <maml:para>Specifies the time of day, as the number of minutes after midnight, to perform a scheduled scan. The time refers to the local time on the computer. If you do not specify a value for this parameter, a scheduled scan runs at the default time of two hours after midnight.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="raat"> <maml:name>ReportingAdditionalActionTimeOut</maml:name> <maml:description> <maml:para>Specifies the number of minutes before a detection in the additional action state changes to the cleared state.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> <dev:type> <maml:name>UInt32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="rcto"> <maml:name>ReportingCriticalFailureTimeOut</maml:name> <maml:description> <maml:para>Specifies the number of minutes before a detection in the critically failed state changes to either the additional action state or the cleared state.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> <dev:type> <maml:name>UInt32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="rncto"> <maml:name>ReportingNonCriticalTimeOut</maml:name> <maml:description> <maml:para>Specifies the number of minutes before a detection in the non-critically failed state changes to the cleared state.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> <dev:type> <maml:name>UInt32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="saclf"> <maml:name>ScanAvgCPULoadFactor</maml:name> <maml:description> <maml:para>Specifies the maximum percentage CPU usage for a scan. The acceptable values for this parameter are: integers from 5 through 100, and the value 0, which disables CPU throttling. Windows Defender does not exceed the percentage of CPU usage that you specify. The default value is 50.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Byte</command:parameterValue> <dev:type> <maml:name>Byte</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="soiie"> <maml:name>ScanOnlyIfIdleEnabled</maml:name> <maml:description> <maml:para>Indicates whether to start scheduled scans only when the computer is not in use. If you specify a value of $True or do not specify a value, Windows Defender runs schedules scans when the computer is on, but not in use. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> <dev:type> <maml:name>Boolean</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ScanParameters</maml:name> <maml:description> <maml:para>Specifies the scan type to use during a scheduled scan. The acceptable values for this parameter are: -- 1: Quick scan -- 2: Full scan If you do not specify this parameter, Windows Defender uses the default value of quick scan.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">ScanType</command:parameterValue> <dev:type> <maml:name>ScanType</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="spiad"> <maml:name>ScanPurgeItemsAfterDelay</maml:name> <maml:description> <maml:para>Specifies the number of days to keep items in the scan history folder. After this time, Windows Defender removes the items. If you specify a value of zero, Windows Defender does not remove items. If you do not specify a value, Windows Defender removes items from the scan history folder after the default length of time, which is 30 days. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> <dev:type> <maml:name>UInt32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="scsd"> <maml:name>ScanScheduleDay</maml:name> <maml:description> <maml:para>Specifies the day of the week on which to perform a scheduled scan. Alternatively, specify everyday for a scheduled scan or never. The acceptable values for this parameter are: -- 0: Everyday -- 1: Sunday -- 2: Monday -- 3: Tuesday -- 4: Wednesday -- 5: Thursday -- 6: Friday -- 7: Saturday -- 8: Never The default value is 8, never. If you specify a value of 8 or do not specify a value, Windows Defender does not perform scheduled scans.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Day</command:parameterValue> <dev:type> <maml:name>Day</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="scsqst"> <maml:name>ScanScheduleQuickScanTime</maml:name> <maml:description> <maml:para>Specifies the time of day, as the number of minutes after midnight, to perform a scheduled quick scan. The time refers to the local time on the computer. If you do not specify a value for this parameter, a scheduled quick scan runs at the time specified by the ScanScheduleTime parameter. That parameter has a default time of two hours after midnight. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="scst"> <maml:name>ScanScheduleTime</maml:name> <maml:description> <maml:para>Specifies the time of day, as the number of minutes after midnight, to perform a scheduled scan. The time refers to the local time on the computer. If you do not specify a value for this parameter, a scheduled scan runs at a default time of two hours after midnight. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="stdefac"> <maml:name>SevereThreatDefaultAction</maml:name> <maml:description> <maml:para>Specifies which automatic remediation action to take for a severe level threat. The acceptable values for this parameter are: -- Quarantine -- Remove -- Ignore </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">ThreatAction</command:parameterValue> <dev:type> <maml:name>ThreatAction</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="sigagp"> <maml:name>SignatureAuGracePeriod</maml:name> <maml:description> <maml:para>Specifies a grace period, in minutes, for the definition. If a definition successfully updates within this period, Windows Defender abandons any service initiated updates.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> <dev:type> <maml:name>UInt32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="sigdufss"> <maml:name>SignatureDefinitionUpdateFileSharesSources</maml:name> <maml:description> <maml:para>Specifies file-share sources for definition updates. Specify sources as a bracketed sequence of Universal Naming Convention (UNC) locations, separated by the pipeline symbol; for example, { \\Server01\Share01 | \\Server02\Share02 | \\Server03\Share03}. If you specify a value for this parameter, Windows Defender attempts to connect to the shares in the order that you specify. After Windows Defender updates a definition, it stops attempting to connect to shares on the list. If you do not specify a value for this parameter, the list is empty.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="sigduoswo"> <maml:name>SignatureDisableUpdateOnStartupWithoutEngine</maml:name> <maml:description> <maml:para>Indicates whether to initiate definition updates even if no antimalware engine is present. If you specify a value of $True or do not specify a value, Windows Defender initiates definition updates on startup. If you specify a value of $False, and if no antimalware engine is present, Windows Defender does not initiate definition updates on startup.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> <dev:type> <maml:name>Boolean</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="sfo"> <maml:name>SignatureFallbackOrder</maml:name> <maml:description> <maml:para>Specifies the order in which to contact different definition update sources. Specify the types of update sources in the order in which you want Windows Defender to contact them, enclosed in braces and separated by the pipeline symbol; for example, { InternalDefinitionUpdateServer | MicrosoftUpdateServer | MMPC }. The values that you can specify in the string are: -- InternalDefinitionUpdateServer -- MicrosoftUpdateServer -- MMPC -- FileShares MMPC refers to Microsoft Malware Protection Center. </maml:para> <maml:para>If you specify a value for this parameter, Windows Defender contacts the definition update sources in the specified order. After Windows Defender downloads definition updates from a source, it stops attempting to connect to other sources. If you do not specify a value for this parameter, Windows Defender contacts sources in the default order of { MicrosoftUpdateServer | MMPC }.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="sigfagp"> <maml:name>SignatureFirstAuGracePeriod</maml:name> <maml:description> <maml:para>Specifies a grace period, in minutes, for the definition. If a definition successfully updates within this period, Windows Defender abandons any service initiated updates. This parameter overrides the value of the CheckForSignaturesBeforeRunningScan parameter.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> <dev:type> <maml:name>UInt32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="sigsd"> <maml:name>SignatureScheduleDay</maml:name> <maml:description> <maml:para>Specifies the day of the week on which to check for definition updates. Alternatively, specify everyday for a scheduled scan or never. The acceptable values for this parameter are: -- 0: Everyday -- 1: Sunday -- 2: Monday -- 3: Tuesday -- 4: Wednesday -- 5: Thursday -- 6: Friday -- 7: Saturday -- 8: Never The default value is 8, never. If you specify a value of 8 or do not specify a value, Windows Defender checks for definition updates by using a default frequency.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Day</command:parameterValue> <dev:type> <maml:name>Day</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="sigst"> <maml:name>SignatureScheduleTime</maml:name> <maml:description> <maml:para>Specifies the time of day, as the number of minutes after midnight, to check for definition updates. The time refers to the local time on the computer. If you do not specify a value for this parameter, Windows Defender checks for definition updates at the default time of 15 minutes before the scheduled scan time. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">DateTime</command:parameterValue> <dev:type> <maml:name>DateTime</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="siguci"> <maml:name>SignatureUpdateCatchupInterval</maml:name> <maml:description> <maml:para>Specifies the number of days after which Windows Defender requires a catch-up definition update. If you do not specify a value for this parameter, Windows Defender requires a catch-up definition update after the default value of one day.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> <dev:type> <maml:name>UInt32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="sigui"> <maml:name>SignatureUpdateInterval</maml:name> <maml:description> <maml:para>Specifies the interval, in hours, at which to check for definition updates. The acceptable values for this parameter are: integers from 1 through 24. If you do not specify a value for this parameter, Windows Defender checks at the default interval. You can use this parameter instead of the SignatureScheduleDay parameter and SignatureScheduleTime parameter. </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UInt32</command:parameterValue> <dev:type> <maml:name>UInt32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>SubmitSamplesConsent</maml:name> <maml:description> <maml:para>Specifies how Windows Defender checks for user consent for certain samples. If consent has previously been granted, Windows Defender submits the samples. Otherwise, if the MAPSReporting parameter does not have a value of Disabled, Windows Defender prompts the user for consent. The acceptable values for this parameter are: --0: Always prompt --1: Send safe samples automatically --2: Never send --3: Send all samples automatically</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">ConsentType</command:parameterValue> <dev:type> <maml:name>ConsentType</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="tiddefaca"> <maml:name>ThreatIDDefaultAction_Actions</maml:name> <maml:description> <maml:para>Specifies an array of the actions to take for the IDs specified by using the ThreatIDDefaultAction_Ids parameter. The acceptable values for this parameter are: -- 1: Clean -- 2: Quarantine -- 3: Remove -- 4: Allow -- 8: UserDefined -- 9: NoAction -- 10: Block</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">ThreatAction[]</command:parameterValue> <dev:type> <maml:name>ThreatAction[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="tiddefaci"> <maml:name>ThreatIDDefaultAction_Ids</maml:name> <maml:description> <maml:para>Specifies an array of threat IDs. This cmdlet modifies the default action for the threat IDs that you specify.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">Int64[]</command:parameterValue> <dev:type> <maml:name>Int64[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>UILockdown</maml:name> <maml:description> <maml:para>Indicates whether to disable UI lockdown mode. If you specify a value of $True, Windows Defender disables UI lockdown mode. If you specify $False or do not specify a value, UI lockdown mode is enabled.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Boolean</command:parameterValue> <dev:type> <maml:name>Boolean</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="unktdefac"> <maml:name>UnknownThreatDefaultAction</maml:name> <maml:description> <maml:para>Specifies which automatic remediation action to take for an unknown level threat. The acceptable values for this parameter are: -- Quarantine -- Remove -- Ignore </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">ThreatAction</command:parameterValue> <dev:type> <maml:name>ThreatAction</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Schedule to check for definition updates everyday</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\> Set-MpPreference -SignatureScheduleDay Everyday </dev:code> <dev:remarks> <maml:para>This command configures preferences to check for definition updates every day.</maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> <command:example> <maml:title>Example 2: Schedule a time of day to check for definition updates </maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\> Set-MpPreference -SignatureScheduleTime 120 </dev:code> <dev:remarks> <maml:para>This command configures preferences to check for definition updates 120 minutes after midnight on days when it is scheduled to check. </maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkID=317471</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Add-MpPreference</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-MpPreference</maml:linkText> <maml:uri /> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Remove-MpPreference</maml:linkText> <maml:uri /> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Start-MpScan</command:name> <maml:description> <maml:para>Starts a scan on a computer. </maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Start</command:verb> <command:noun>MpScan</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Start-MpScan cmdlet starts a scan on a computer. The cmdlet performs scans for the path you specify. </maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Start-MpScan</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="infa"> <maml:name>InformationAction</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">SilentlyContinue</command:parameterValue> <command:parameterValue required="false" variableLength="false">Stop</command:parameterValue> <command:parameterValue required="false" variableLength="false">Continue</command:parameterValue> <command:parameterValue required="false" variableLength="false">Inquire</command:parameterValue> <command:parameterValue required="false" variableLength="false">Ignore</command:parameterValue> <command:parameterValue required="false" variableLength="false">Suspend</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="iv"> <maml:name>InformationVariable</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.String</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ScanPath</maml:name> <maml:description> <maml:para>Specifies a file or a folder path to scan. Specify a file name, a folder name, such as C:\, or a UNC path.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">String</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ScanType</maml:name> <maml:description> <maml:para>Specifies the type of scan. The acceptable values for this parameter are: -- FullScan -- QuickScan -- CustomScan</maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">QuickScan</command:parameterValue> <command:parameterValue required="false" variableLength="false">FullScan</command:parameterValue> <command:parameterValue required="false" variableLength="false">CustomScan</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="infa"> <maml:name>InformationAction</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.Management.Automation.ActionPreference</command:parameterValue> <dev:type> <maml:name>System.Management.Automation.ActionPreference</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="iv"> <maml:name>InformationVariable</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.String</command:parameterValue> <dev:type> <maml:name>System.String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ScanPath</maml:name> <maml:description> <maml:para>Specifies a file or a folder path to scan. Specify a file name, a folder name, such as C:\, or a UNC path.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ScanType</maml:name> <maml:description> <maml:para>Specifies the type of scan. The acceptable values for this parameter are: -- FullScan -- QuickScan -- CustomScan</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">ScanType</command:parameterValue> <dev:type> <maml:name>ScanType</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Start a scan</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\> Start-MpScan </dev:code> <dev:remarks> <maml:para>This command starts a scan on the computer on which you run the cmdlet.</maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkId=317472</maml:uri> </maml:navigationLink> </maml:relatedLinks> </command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Update-MpSignature</command:name> <maml:description> <maml:para>Updates the antimalware definitions on a computer.</maml:para> </maml:description> <maml:copyright> <maml:para /> </maml:copyright> <command:verb>Update</command:verb> <command:noun>MpSignature</command:noun> <dev:version /> </command:details> <maml:description> <maml:para>The Update-MpSignature cmdlet updates the antimalware definitions with the latest definitions available on an update server. </maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Update-MpSignature</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="infa"> <maml:name>InformationAction</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">SilentlyContinue</command:parameterValue> <command:parameterValue required="false" variableLength="false">Stop</command:parameterValue> <command:parameterValue required="false" variableLength="false">Continue</command:parameterValue> <command:parameterValue required="false" variableLength="false">Inquire</command:parameterValue> <command:parameterValue required="false" variableLength="false">Ignore</command:parameterValue> <command:parameterValue required="false" variableLength="false">Suspend</command:parameterValue> </command:parameterValueGroup> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="iv"> <maml:name>InformationVariable</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.String</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>UpdateSource</maml:name> <maml:description> <maml:para>Specifies an update source. This cmdlet downloads updated definitions from the server you specify. If you do not specify this parameter, the cmdlet uses the Microsoft Update Server, then Microsoft Malware Protection Center (MMPC), as an update source. The acceptable values for this parameter are: -- InternalDefinitionUpdateServer -- MicrosoftUpdateServer -- MMPC -- FileShares If you specify the InternalDefinitionUpdateServer setting, the service checks for updates on the Windows Software Update Services (WSUS) server.</maml:para> </maml:description> <command:parameterValueGroup> <command:parameterValue required="false" variableLength="false">InternalDefinitionUpdateServer</command:parameterValue> <command:parameterValue required="false" variableLength="false">MicrosoftUpdateServer</command:parameterValue> <command:parameterValue required="false" variableLength="false">MMPC</command:parameterValue> <command:parameterValue required="false" variableLength="false">FileShares</command:parameterValue> </command:parameterValueGroup> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"> <maml:name>CimSession</maml:name> <maml:description> <maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="true">CimSession[]</command:parameterValue> <dev:type> <maml:name>CimSession[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="infa"> <maml:name>InformationAction</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.Management.Automation.ActionPreference</command:parameterValue> <dev:type> <maml:name>System.Management.Automation.ActionPreference</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="iv"> <maml:name>InformationVariable</maml:name> <maml:description> <maml:para> </maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">System.String</command:parameterValue> <dev:type> <maml:name>System.String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>ThrottleLimit</maml:name> <maml:description> <maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">Int32</command:parameterValue> <dev:type> <maml:name>Int32</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases="none"> <maml:name>UpdateSource</maml:name> <maml:description> <maml:para>Specifies an update source. This cmdlet downloads updated definitions from the server you specify. If you do not specify this parameter, the cmdlet uses the Microsoft Update Server, then Microsoft Malware Protection Center (MMPC), as an update source. The acceptable values for this parameter are: -- InternalDefinitionUpdateServer -- MicrosoftUpdateServer -- MMPC -- FileShares If you specify the InternalDefinitionUpdateServer setting, the service checks for updates on the Windows Software Update Services (WSUS) server.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">UpdateSource</command:parameterValue> <dev:type> <maml:name>UpdateSource</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>none</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name> </maml:name> <maml:uri> </maml:uri> <maml:description> <maml:para /> </maml:description> </dev:type> <maml:description> </maml:description> </command:returnValue> </command:returnValues> <command:terminatingErrors /> <command:nonTerminatingErrors /> <command:examples> <command:example> <maml:title>Example 1: Update signatures</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\> Update-MpSignature </dev:code> <dev:remarks> <maml:para>This command updates the antimalware definitions. By default, the cmdlet uses the default update source.</maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> <command:example> <maml:title>Example 2: Update signatures from a specific source</maml:title> <maml:introduction> <maml:para> </maml:para> </maml:introduction> <dev:code>PS C:\> Update-MpSignature -UpdateSource MicrosoftUpdateServer </dev:code> <dev:remarks> <maml:para>This command updates the antimalware definitions from the Microsoft Update Server.</maml:para> <maml:para /> <maml:para /> </dev:remarks> <command:commandLines> <command:commandLine> <command:commandText /> </command:commandLine> </command:commandLines> </command:example> </command:examples> <maml:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>http://go.microsoft.com/fwlink/?LinkId=317473</maml:uri> </maml:navigationLink> </maml:relatedLinks> </command:command> </helpItems> |