Configure Run Antivirus Scan capability in Microsoft Defender for Endpoint

Remotely initiate an anti virus scan to help identify and remediate malware that might be present on a compromised device. Run the scan as part of the investigation or response process.

Before you begin

Role required: sn_si.admin or sn_si.analyst

Procedure

1. Navigate to Security Incidents > Show All Incidents.

2. Select the security incident that you want to review with the Microsoft Defender for Endpoint information.

   1. In the related links section, select Run Additional Actions on Endpoint.

   2. Browse and select the required capability.

      For example, select Run Antivirus Scan capability.

   Alternatively, you can perform the following steps:

   1. In the related lists section, select Show All Related Lists.
   2. Select the Configuration Item related list.
   3. Select the added configuration items, and from the Actions on selected rows, select Run Additional Actions on Endpoint. After you select the Run Antivirus Scan capability implementation, the Additional Scan Type and Comment input fields are displayed.

3. Select the Scan type that you want to run (Quick or Full), and add a comment before executing the scan.

4. To initiate the anti virus scan, select Run Additional Action.

5. View the automation activities of the execution, and validate them.

6. Validate the status of the action on the Additional Actions on Endpoint related lists.

Parent Topic:Additional Configurations in Microsoft Defender for Endpoint

Related topics

Configure Isolate Host capability in Microsoft Defender for Endpoint

Configure Remove Host Isolation capability in Microsoft Defender for Endpoint

Configure Restrict App Execution capability in Microsoft Defender for Endpoint

Configure Remove App Restriction capability in Microsoft Defender for Endpoint

Configure Get Related Machines from Defender Capability in Microsoft Defender for Endpoint

Configure Stop and Quarantine File capability in Microsoft Defender for Endpoint