How to Run Antivirus Scans Remotely in Microsoft Defender for Endpoint

Microsoft Defender for Endpoint enables security teams to initiate antivirus scans on remote devices directly from the cloud portal. This capability is essential for investigating potential infections, responding to alerts, and performing routine security checks without requiring physical access or end-user involvement.

Prerequisites

Before running remote scans, ensure:

• Device is onboarded to Microsoft Defender for Endpoint
• Device is online and communicating with the Defender cloud
• Appropriate permissions: Security Operator or Security Administrator role
• Microsoft Defender Antivirus is active (not in passive mode)

Understanding Scan Types

Step 1: Navigate to the Device

1. Sign in to the Microsoft Defender portal
2. Go to Assets > Devices
3. Search for the target device by name, IP, or user
4. Click on the device to open its details page
5. Verify the device shows Active status

Step 2: Initiate a Remote Scan

Run a Quick Scan

1. On the device page, click the ... (ellipsis) menu in the top right
2. Select Run antivirus scan
3. Choose Quick scan
4. Add an optional comment explaining why you're running the scan
5. Click Confirm

The scan will start within a few minutes when the device next checks in.

Run a Full Scan

1. On the device page, click the ... menu
2. Select Run antivirus scan
3. Choose Full scan
4. Add a comment (recommended for audit trail)
5. Click Confirm

Note: Full scans can take several hours. Consider scheduling these during off-hours or maintenance windows.

Step 3: Run Scans on Multiple Devices

Using Bulk Actions

1. Go to Assets > Devices
2. Use filters to select target devices:
   • Filter by Device group
   • Filter by Health state
   • Filter by Tag
3. Select multiple devices using checkboxes
4. Click Actions in the toolbar
5. Select Run antivirus scan
6. Choose scan type and confirm

Using Device Groups

For routine scanning of specific device categories:

1. Navigate to Settings > Endpoints > Device groups
2. Identify or create a device group for target devices
3. Use the group filter in device inventory
4. Perform bulk scan action on the filtered list

Step 4: Monitor Scan Progress

Check Action Center

1. Go to Actions & submissions > Action center
2. Select the History tab
3. Filter by:
   • Action type: Antivirus scan
   • Initiator: Your account
4. View scan status: Pending, Running, Completed, Failed

Check Device Timeline

1. Open the device details page
2. Click on Timeline
3. Filter events by Antivirus category
4. Look for scan-related entries:
   • AntivirusScanInitiated
   • AntivirusScanCompleted
   • ThreatDetected (if malware found)

Review Scan Results

After scan completion, check results in the timeline:

Event: AntivirusScanCompleted
Scan Type: QuickScan
Start Time: 2025-01-15 14:30:00
End Time: 2025-01-15 14:35:42
Files Scanned: 45,231
Threats Detected: 0

If threats are detected, additional events will show:

• Threat name and category
• File path and hash
• Remediation action taken

Step 5: Run Custom Path Scans

For targeted investigations, scan specific folders:

Using PowerShell Live Response

1. On the device page, click Initiate Live Response Session
2. Wait for the session to connect
3. Run a custom scan command:

# Scan a specific folder
Start-MpScan -ScanPath "C:\Users\username\Downloads" -ScanType CustomScan

# Scan multiple paths
$paths = @("C:\Temp", "D:\Shared", "C:\Users\Public")
foreach ($path in $paths) {
    Start-MpScan -ScanPath $path -ScanType CustomScan
}

4. Monitor scan output in the Live Response console

Using API

For automation, use the Microsoft Defender API:

# Initiate scan via API
curl -X POST "https://api.securitycenter.microsoft.com/api/machines/{machineId}/runAntiVirusScan" \
  -H "Authorization: Bearer {access_token}" \
  -H "Content-Type: application/json" \
  -d '{"Comment": "Scan initiated via API", "ScanType": "Quick"}'

Step 6: Configure Scheduled Scans

For proactive protection, configure scheduled scans via policy:

Using Microsoft Intune

1. Go to Intune admin center
2. Navigate to Endpoint security > Antivirus
3. Create a new policy or edit existing
4. Configure scan settings:

5. Assign to device groups

Using Group Policy

For domain-joined devices:

1. Open Group Policy Management
2. Navigate to: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Scan
3. Configure policies:
   • Specify the scan type for scheduled scan: Quick scan
   • Specify the day of the week to run a scheduled scan: Every day
   • Specify the time of day to run a scheduled scan: 720 (12:00 PM)

Troubleshooting

Scan Won't Start

Symptoms: Scan action shows "Pending" for extended time.

Solutions:

1. Verify device is online and active
2. Check that Defender Antivirus is enabled (not in passive mode)
3. Ensure no other scan is currently running
4. Restart the Sense service on the device:

   Restart-Service -Name Sense
   

   Copy

Scan Fails

Symptoms: Action shows "Failed" in Action Center.

Solutions:

1. Check device health status in portal
2. Review Windows Event Logs on device:
   • Event Viewer > Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational
3. Ensure sufficient disk space for scan operations
4. Verify no third-party AV is conflicting

Slow Scan Performance

Symptoms: Full scans take excessively long.

Solutions:

1. Configure scan exclusions for known-good large folders
2. Set scan to low CPU priority
3. Exclude files by type (e.g., database files, ISO images)
4. Schedule scans during maintenance windows

Best Practices

When to Use Remote Scans

• Alert follow-up: Scan after investigating an alert
• User-reported issues: When user reports suspicious activity
• Routine verification: Periodic checks on critical systems
• Post-remediation: Confirm threats were removed

Scan Optimization Tips

1. Use quick scans routinely: Full scans are resource-intensive
2. Configure exclusions: Exclude known-safe, frequently-scanned locations
3. Schedule off-hours: Run full scans during nights or weekends
4. Monitor completion: Ensure scans finish successfully
5. Review results: Check scan logs for detected and remediated threats

Exclusion Recommendations

Common exclusions to improve scan performance:

Warning: Only exclude paths you trust. Never exclude user-writable folders like Downloads or Temp.

Next Steps

After mastering remote scans:

• Investigate security incidents using scan results
• Configure Attack Surface Reduction rules for prevention
• Set up automated remediation for detected threats
• Configure cloud-delivered protection for real-time threat updates

Need comprehensive endpoint protection management? Inventive HQ provides 24/7 managed detection and response services for Microsoft Defender for Endpoint. Contact us to learn more.