Created
August 15, 2025 22:14
-
-
Save jschell/93166c14f4f1e095a3d71ab27e1fbf55 to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| function New-DefenderScan | |
| { | |
| <# | |
| .Synopsis | |
| Scan the provided folder or file with Windows Defender | |
| .Description | |
| Scan the provided folder or file with Windows Defender | |
| .Example | |
| New-DefenderScan -PathToScan C:\users\Public\Documents | |
| Scan starting... | |
| Scan finished. | |
| Scanning C:\users\Public\Documents found no threats. | |
| .Example | |
| New-DefenderScan -PathToScan 'C:\users\Public\Documents\my file.txt' -DisableRemediation | |
| Scan starting... | |
| Scan finished. | |
| Scanning C:\users\Public\Documents\my file.txt found no threats. | |
| .NOTES | |
| #### Name: New-DefenderScan | |
| #### Author: J Schell | |
| #### Version: 0.1.1 | |
| #### License: MIT | |
| ### Change Log | |
| ##### 2019-09-12::0.1.1 | |
| - after significant wrangling, paths with spaces are properly fed to Defender | |
| ##### 2019-09-12::0.1.0 | |
| - initial create | |
| - known issue when sending | |
| #> | |
| [CmdletBinding()] | |
| param | |
| ( | |
| [Parameter()] | |
| [string]$PathToScan, | |
| [Parameter()] | |
| [Switch]$DisableRemediation | |
| ) | |
| Begin | |
| { | |
| $defenderPath = "$($env:programfiles)\Windows Defender\mpcmdrun.exe" | |
| if( !(Test-Path -Path $defenderPath)) | |
| { | |
| Throw "Could not find Defender in expected (programfiles) location." | |
| Break | |
| } | |
| if( !(Test-Path -Path $PathToScan)) | |
| { | |
| Throw "Could not find Path to Scan provided location." | |
| Break | |
| } | |
| } | |
| Process | |
| { | |
| $paramMPCmd = @() | |
| $paramMPCmd += @("-scan") | |
| $paramMPCmd += @("-scantype") | |
| $paramMPCmd += @("3") | |
| $paramMPCmd += @("-file") | |
| $paramMPCmd += @("$($PathToScan)") | |
| if($DisableRemediation) | |
| { | |
| $paramMPCmd += @("-disableremediation") | |
| } | |
| Write-Verbose "ScanPath : $($PathToScan)" | |
| Write-Verbose "paramMPCmd : $($paramMPCmd)" | |
| $scanResult = & "$defenderPath" $paramMPCmd | |
| } | |
| End | |
| { | |
| $scanResult | |
| } | |
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment