Manage Microsoft Defender Antivirus updates and scans for endpoints that are out of date

Microsoft Defender Antivirus lets you define how long an endpoint can avoid an update or how many scans it can miss before it is required to update and scan itself. This is especially useful in environments where devices are not often connected to a corporate or external network, or devices that are not used on a daily basis.

For example, an employee that uses a particular PC is on break for three days and does not log on to their PC during that time.

When the user returns to work and logs on to their PC, Microsoft Defender Antivirus will immediately check and download the latest protection updates, and run a scan.

Set up catch-up protection updates for endpoints that haven’t updated for a while

If Microsoft Defender Antivirus did not download protection updates for a specified period, you can set it up to automatically check and download the latest update at the next log on. This is useful if you have globally disabled automatic update downloads on startup.

Use Configuration Manager to configure catch-up protection updates

1. On your Microsoft Endpoint Manager console, open the antimalware policy you want to change (click Assets and Compliance in the navigation pane on the left, then expand the tree to Overview > Endpoint Protection > Antimalware Policies)
2. Go to the Security intelligence updates section and configure the following settings:
   1. Set Force a security intelligence update if the client computer is offline for more than two consecutive scheduled updates to Yes.
   2. For the If Configuration Manager is used as a source for security intelligence updates…, specify the hours before which the protection updates delivered by Configuration Manager should be considered out-of-date. This will cause the next update location to be used, based on the defined fallback source order.
3. Click OK.
4. Deploy the updated policy as usual.

Use Group Policy to enable and configure the catch-up update feature

1. On your Group Policy management computer, open the Group Policy Management Console, right-click the Group Policy Object you want to configure and click Edit.
2. In the Group Policy Management Editor go to Computer configuration.
3. Click Policies then Administrative templates.
4. Expand the tree to Windows components > Microsoft Defender Antivirus > Signature Updates.
5. Double-click the Define the number of days after which a catch-up security intelligence update is required setting and set the option to Enabled. Enter the number of days after which you want Microsoft Defender AV to check for and download the latest protection update.
6. Click OK.

Use PowerShell cmdlets to configure catch-up protection updates

Use the following cmdlets:

Set-MpPreference -SignatureUpdateCatchupInterval

See Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus and Defender Antivirus cmdlets for more information on how to use PowerShell with Microsoft Defender Antivirus.

Use Windows Management Instruction (WMI) to configure catch-up protection updates

Use the Set method of the MSFT_MpPreference class for the following properties:

SignatureUpdateCatchupInterval

See the following for more information and allowed parameters:

• Windows Defender WMIv2 APIs

Set the number of days before protection is reported as out-of-date

You can also specify the number of days after which Microsoft Defender Antivirus protection is considered old or out-of-date. After the specified number of days, the client will report itself as out-of-date, and show an error to the user of the PC. It may also cause Microsoft Defender Antivirus to attempt to download an update from other sources (based on the defined fallback source order), such as when using MMPC as a secondary source after setting WSUS or Microsoft Update as the first source.

Use Group Policy to specify the number of days before protection is considered out-of-date

1. On your Group Policy management machine, open the Group Policy Management Console, right-click the Group Policy Object you want to configure and click Edit.
2. In the Group Policy Management Editor go to Computer configuration.
3. Click Policies then Administrative templates.
4. Expand the tree to Windows components > Microsoft Defender Antivirus > Signature Updates and configure the following settings:
   1. Double-click Define the number of days before spyware definitions are considered out of date and set the option to Enabled. Enter the number of days after which you want Microsoft Defender AV to consider spyware Security intelligence to be out-of-date.
   2. Click OK.
   3. Double-click Define the number of days before virus definitions are considered out of date and set the option to Enabled. Enter the number of days after which you want Microsoft Defender AV to consider virus Security intelligence to be out-of-date.
   4. Click OK.

Set up catch-up scans for endpoints that have not been scanned for a while

You can set the number of consecutive scheduled scans that can be missed before Microsoft Defender Antivirus will force a scan.

The process for enabling this feature is:

1. Set up at least one scheduled scan (see the Schedule scans topic).
2. Enable the catch-up scan feature.
3. Define the number of scans that can be skipped before a catch-up scan occurs.

This feature can be enabled for both full and quick scans.

Use Group Policy to enable and configure the catch-up scan feature

1. Ensure you have set up at least one scheduled scan.
2. On your Group Policy management machine, open the Group Policy Management Console, right-click the Group Policy Object you want to configure and click Edit.
3. In the Group Policy Management Editor go to Computer configuration.
4. Click Policies then Administrative templates.
5. Expand the tree to Windows components > Microsoft Defender Antivirus > Scan and configure the following settings:
   1. If you have set up scheduled quick scans, double-click the Turn on catch-up quick scan setting and set the option to Enabled.
   2. If you have set up scheduled full scans, double-click the Turn on catch-up full scan setting and set the option to Enabled. Click OK.
   3. Double-click the Define the number of days after which a catch-up scan is forced setting and set the option to Enabled.
   4. Enter the number of scans that can be missed before a scan will be automatically run when the user next logs on to the PC. The type of scan that is run is determined by the Specify the scan type to use for a scheduled scan (see the Schedule scans topic). Click OK.

Use PowerShell cmdlets to configure catch-up scans

Use the following cmdlets:

Set-MpPreference -DisableCatchupFullScan
Set-MpPreference -DisableCatchupQuickScan

See Use PowerShell cmdlets to manage Microsoft Defender Antivirus and Defender Antivirus cmdlets for more information on how to use PowerShell with Microsoft Defender Antivirus.

Use Windows Management Instruction (WMI) to configure catch-up scans

Use the Set method of the MSFT_MpPreference class for the following properties:

DisableCatchupFullScan
DisableCatchupQuickScan

See the following for more information and allowed parameters:

• Windows Defender WMIv2 APIs

Use Configuration Manager to configure catch-up scans

1. On your Microsoft Endpoint Manager console, open the antimalware policy you want to change (click Assets and Compliance in the navigation pane on the left, then expand the tree to Overview > Endpoint Protection > Antimalware Policies)
2. Go to the Scheduled scans section and Force a scan of the selected scan type if client computer is offline… to Yes.
3. Click OK.
4. Deploy the updated policy as usual.

Source : Official Microsoft Brand
Editor by : BEST Antivirus KBS Team