Skip to content

Instantly share code, notes, and snippets.

@jschell
Created August 15, 2025 22:14
Show Gist options
  • Select an option

  • Save jschell/93166c14f4f1e095a3d71ab27e1fbf55 to your computer and use it in GitHub Desktop.

Select an option

Save jschell/93166c14f4f1e095a3d71ab27e1fbf55 to your computer and use it in GitHub Desktop.
function New-DefenderScan
{
<#
.Synopsis
Scan the provided folder or file with Windows Defender
.Description
Scan the provided folder or file with Windows Defender
.Example
New-DefenderScan -PathToScan C:\users\Public\Documents
Scan starting...
Scan finished.
Scanning C:\users\Public\Documents found no threats.
.Example
New-DefenderScan -PathToScan 'C:\users\Public\Documents\my file.txt' -DisableRemediation
Scan starting...
Scan finished.
Scanning C:\users\Public\Documents\my file.txt found no threats.
.NOTES
#### Name: New-DefenderScan
#### Author: J Schell
#### Version: 0.1.1
#### License: MIT
### Change Log
##### 2019-09-12::0.1.1
- after significant wrangling, paths with spaces are properly fed to Defender
##### 2019-09-12::0.1.0
- initial create
- known issue when sending
#>
[CmdletBinding()]
param
(
[Parameter()]
[string]$PathToScan,
[Parameter()]
[Switch]$DisableRemediation
)
Begin
{
$defenderPath = "$($env:programfiles)\Windows Defender\mpcmdrun.exe"
if( !(Test-Path -Path $defenderPath))
{
Throw "Could not find Defender in expected (programfiles) location."
Break
}
if( !(Test-Path -Path $PathToScan))
{
Throw "Could not find Path to Scan provided location."
Break
}
}
Process
{
$paramMPCmd = @()
$paramMPCmd += @("-scan")
$paramMPCmd += @("-scantype")
$paramMPCmd += @("3")
$paramMPCmd += @("-file")
$paramMPCmd += @("$($PathToScan)")
if($DisableRemediation)
{
$paramMPCmd += @("-disableremediation")
}
Write-Verbose "ScanPath : $($PathToScan)"
Write-Verbose "paramMPCmd : $($paramMPCmd)"
$scanResult = & "$defenderPath" $paramMPCmd
}
End
{
$scanResult
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment