As you can see, the service is started (Status – Running)

You can display the current status and settings of Defender using the following cmdlet:

Get-MpComputerStatus

The cmdlet displays the version and the date of the latest antivirus database update (AntivirusSignatureLastUpdated, AntispywareSignatureLastUpdated), enabled antivirus components, the time of the last scan (QuickScanStartTime), etc.

You can disable Windows Defender real time protection as follows:

Set-MpPreference -DisableRealtimeMonitoring $true

After executing this command, the antivirus will not scan in real time all files that are opened by the operating system or users.

For example, you need to enable scanning for external USB storage devices. Get the current settings with command:

Get-MpPreference | fl disable*

If the USB drive scanning is disabled (DisableRemovableDriveScanning = True), you can enable the scan using the command:

Set-MpPreference -DisableRemovableDriveScanning $false

A complete list of PowerShell cmdlets in the Windows Defender module can be displayed with the command:

Get-Command -Module Defender

How to Exclude Files and Folder from Windows Defender Antivirus Scans?

You can set the list of exclusions – these are names, file extensions, directories to be excluded from the automatic Windows Defender Antivirus scan. The peculiarity of Windows Defender in Windows Server 2019/2016 is the automatically generated list of exclusions applied depending on the installed Windows Server roles and features.

For example, if the Hyper-V role is installed, the following object will be added to the Defender exclusion list: virtual and differencing disks, VHDS disks (*.vhd, *.vhdx, *.avhd), snapshots, Hyper-V folders and processes (Vmms. exe, Vmwp.exe).

If you want to disable Microsoft Defender automatic exclusions on Windows Server, run the command:

Set-MpPreference -DisableAutoExclusions $true

To add the specific directories to the antivirus exclusion list manually, run this command:

Set-MpPreference -ExclusionPath "C:\ISO", "C:\VM", "C:\Nano"

To exclude antivirus scanning of certain processes use the following command:

Set-MpPreference -ExclusionProcess "vmms.exe", "Vmwp.exe"

Get Windows Defender Status Reports from Remote Computers via PowerShell

You can get the Microsoft Defender Antivirus status from remote computers using PowerShell. The following simple script will find all Windows Server hosts in the AD domain and get the Defender state through WinRM (using the Invoke-Command cmdlet):

$Report = @()
$servers= Get-ADComputer -Filter 'operatingsystem -like "*server*" -and enabled -eq "true"'| Select-Object -ExpandProperty Name
foreach ($server in $servers) {
$defenderinfo= Invoke-Command $server -ScriptBlock {Get-MpComputerStatus | Select-Object -Property Antivirusenabled,RealTimeProtectionEnabled,AntivirusSignatureLastUpdated,QuickScanAge,FullScanAge}
If ($defenderinfo) {
$objReport = [PSCustomObject]@{
User = $defenderinfo.PSComputername
Antivirusenabled = $defenderinfo.Antivirusenabled
RealTimeProtectionEnabled = $defenderinfo.RealTimeProtectionEnabled
AntivirusSignatureLastUpdated = $defenderinfo.AntivirusSignatureLastUpdated
QuickScanAge = $defenderinfo.QuickScanAge
FullScanAge = $defenderinfo.FullScanAge
}
$Report += $objReport
}
}
$Report|ft

To get information about antivirus detections, you can use the following PowerShell script:

$Report = @()
$servers = Get-ADComputer -Filter 'operatingsystem -like "*server*" -and enabled -eq "true"'| Select-Object -ExpandProperty Name
foreach ($server in $servers) {
$defenderalerts= Invoke-Command $server -ScriptBlock {Get-MpThreatDetection | Select-Object -Property DomainUser,ProcessName,InitialDetectionTime ,CleaningActionID,Resources }
If ($defenderalerts) {
foreach ($defenderalert in $defenderalerts) {
$objReport = [PSCustomObject]@{
Computer = $defenderalert.PSComputername
DomainUser = $defenderalert.DomainUser
ProcessName = $defenderalert.ProcessName
InitialDetectionTime = $defenderalert.InitialDetectionTime
CleaningActionID = $defenderalert.CleaningActionID
Resources = $defenderalert.Resources
}
$Report += $objReport
}
}
}
$Report|ft

The report shows the name of the infected file, the action performed, the user, and the owner process.

Updating Windows Defender Antivirus Definitions

Windows Defender Antivirus can automatically update online from Windows Update servers. If there is an internal WSUS server in your network, the Microsoft antivirus can receive updates from it. You just need to make sure that the installation of updates has been approved on your WSUS server (Windows Defender Antivirus updates are called Definition Updates in the WSUS console), and clients are targeted to the correct WSUS server using GPO.

In some cases, Windows Defender may work incorrectly after getting a broken update. Then it is recommended to reset current definitions database and download them again:

"%PROGRAMFILES%\Windows Defender\MPCMDRUN.exe" -RemoveDefinitions -All
"%PROGRAMFILES%\Windows Defender\MPCMDRUN.exe" –SignatureUpdate

If your Windows Server does not have direct access to the Internet, you can update Microsoft Defender from a network folder.

Download Windows Defender updates manually (https://www.microsoft.com/en-us/wdsi/defenderupdates) and place them to a shared network folder. Set the path to the shared folder with Defender updates:
Set-MpPreference -SignatureDefinitionUpdateFileSharesSources \\mun-fs01\Defender

Run the antivirus definition update:

Update-MpSignature -UpdateSource FileShares

Configure Windows Defender Using Group Policy

You can manage basic Microsoft Defender settings on computers and servers using Group Policy. Use the following GPO section: Computer Configurations -> Administrative Template -> Windows Component -> Windows Defender Antivirus.

This section provides over 100 different options for managing Microsoft Defender settings.

For example, to completely disable your antivirus, you must enable the GPO parameter “Turn off Windows Defender Antivirus”.

More information on the available Defender Group Policy settings can be found here. https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/use-group-policy-microsoft-defender-antivirus

Windows Defender centralized management is available via the Advanced Threat Protection on the Azure Security Center (ASC) portal with a paid subscription (about $15 per host/month).