Microsoft Defender Antivirus on Windows Server from PowerShell

Goal

Check Microsoft Defender Antivirus's status and signature age, force a signature update, run an on-demand scan, and review configured exclusions on Windows Server from a PowerShell session, without the GUI.

Prerequisites

An elevated administrator session; Windows Server 2016 or later, where Microsoft Defender Antivirus and its Defender PowerShell module are installed by default (check Get-WindowsFeature Windows-Defender if the cmdlets are missing). If another antivirus product is installed, check AMRunningMode in step 1: on Windows Server, Defender does not switch to passive mode on its own.

Steps

1. Check overall status and signature freshness in one call: Get-MpComputerStatus. The cmdlet returns fields including AntivirusEnabled, AntivirusSignatureAge and AntivirusSignatureLastUpdated, letting you script a freshness threshold (e.g. flag anything with AntivirusSignatureAge -gt 2).
2. Force a signature update outside the normal schedule: Update-MpSignature, documented as updating "the antimalware definitions on a computer"; without -UpdateSource it uses the configured fallback order, and -UpdateSource accepts InternalDefinitionUpdateServer (WSUS), MicrosoftUpdateServer, MMPC or FileShares.
3. Run an on-demand scan: Start-MpScan -ScanType QuickScan or -ScanType FullScan; Start-MpScan -ScanType CustomScan -ScanPath D:\data scans one folder. The cmdlet waits until the scan ends, which for a full scan can take hours; add -AsJob in unattended sessions.
4. Review configured exclusions before trusting a clean scan: Get-MpPreference | Select-Object ExclusionPath, ExclusionExtension, ExclusionProcess. Get-MpPreference "gets preferences for the Windows Defender scans and updates," including every exclusion category.
5. Apply the least-exclusions principle: remove any exclusion path, extension or process that is not backed by a documented, current operational reason (a specific backup agent, a specific database engine) with Remove-MpPreference -ExclusionPath <path>; each exclusion is filesystem or process activity Defender never inspects. Exclusions delivered by Group Policy or Intune must be changed there, or they return at the next policy refresh.
6. Detections are recorded in the Windows Event Log under Microsoft-Windows-Windows Defender/Operational and can be queried in PowerShell with Get-MpThreatDetection, which lists recent detections independently of the live scan output.

Expected result

Get-MpComputerStatus reports AntivirusEnabled: True and a recent AntivirusSignatureLastUpdated; Get-MpPreference's exclusion lists match an approved, documented set; a deliberate scan of a folder containing the EICAR test file (where policy allows using it) produces a detection visible via Get-MpThreatDetection.

Limits and test basis

Removing an exclusion can slow a workload that depended on it being unscanned — remove one at a time and monitor before removing the next. To undo an exclusion change, re-add it with Add-MpPreference -ExclusionPath <path> (its counterpart for adding rather than reading exclusions) using the value captured in step 4. None of these steps requires a reboot.