Skip to content
English
Contact us
  • There are no suggestions because the search field is empty.

Run Defender Antivirus Scan [FIX-9006]

This remediation triggers a Microsoft Defender antivirus scan on a target device through the Microsoft Defender API. The scan type (Quick or Full) is taken from the Defender AV Scan Type configuration. It is a lightweight response action used to check a device for known malicious files after a detection or as part of validating that a device is clean.

The action is non-disruptive: the device stays online and the user can keep working while the scan runs in the background. The remediation submits the scan request and records the returned action id so its progress can be tracked in the Defender Action center.

Rationale

When a device generates a suspicious detection, an on-demand antivirus scan is a fast first step to confirm whether known malware is present and to let Defender remediate anything it finds. A Quick scan checks the locations where threats most commonly hide and completes in minutes; a Full scan inspects the entire file system and is used when a deeper sweep is warranted, for example after a confirmed compromise or when a Quick scan comes back clean but suspicion remains.

Because the scan does not isolate or disrupt the device, it is safe to run early and broadly during triage. It complements heavier containment actions: run a scan to assess and clean a device, and escalate to network isolation (FIX-9007) if the device needs to be contained while investigation continues.

This remediation POSTs to the Defender runAntiVirusScan machine action API with the configured scan type and a comment identifying Attic as the initiator. It requires the Machine.Scan permission on the Microsoft Defender (WindowsDefenderATP) application.

Fix

An automated fix is available through Attic.

Manual steps:

  1. Navigate to the Microsoft Defender portal at https://security.microsoft.com
  2. Go to Assets > Devices
  3. Search for and select the affected device
  4. Open the device page and click Run antivirus scan in the action bar
  5. Choose Quick scan or Full scan
  6. Enter a comment describing why the scan is being triggered
  7. Click Confirm and track progress on the Action center page

Impact

  • An antivirus scan is queued on the device; Defender remediates known threats it finds according to policy.
  • The device is not isolated or disrupted; the user can continue working while the scan runs.
  • A Full scan can take significant time and use device resources; a Quick scan completes in minutes.
  • The action only runs on devices onboarded to Microsoft Defender for Endpoint.
  • Scan results and any remediated threats are visible on the device's timeline and in the Action center.

Revert

There is nothing to revert. A scan is a read-and-clean operation, not a configuration change: no setting is altered, no access is removed, and the device keeps working throughout.

A scan action that has not started yet can be cancelled in the Defender portal under Action center > History: select the action and choose Cancel. This stops the scan only; it does not undo anything already remediated.

Files Defender quarantined during the scan can be restored individually if they prove to be false positives:

  1. Navigate to https://security.microsoft.com and open the device page
  2. Go to the Timeline, or open Action center > History
  3. Select the quarantine action and choose Restore, or restore locally on the device from Windows Security > Virus & threat protection > Protection history

More Information