Hello experts, I'm starting with Intune... been playing with it for few weeks already and want to start deploying some policies to my testing devices. These days, I'm struggling to find out how to properly configure Quick and Full scans via Intune. I've configured a policy in Intune->Endpoint Security->Antivirus as below: Disable Catchup Quick Scan - EnabledScan Parameter - Full ScanSchedule Quick Scan Time - Configured (720)Schedule Scan Day - ThursdaySchedule Scan Time - Configured (600) I want to:run Quick scan daily at 12 PMrun Full scan on Thursdays at 10 AMrun catchup scan for quick scans Is my configuration correct? As I do not see any status changes for Last Full / Last Quick scan in Defender ->Endpoint -when checking my testing devices. All other Status Types are green (Platform, Security Intelligence, Engine, Defender Antivirus Mode - Active) what am I missing here?been trying to do research online... but still not clear in this so hopefully I get some advise here 🙂 PS: M365 E3 + Security E5 addon is assigned to testing users

VladanOEI I walked into the same situation and solved it the following way.It's either a QuickScan(Default) or a FullScan config in Intune. You can not configure them both.I chose to configure a QuickScan(Default) with these settings.Scantype: QuickscanSchedule Scanday: Every day (Default)Schedule Scan Time: 720 I created a powershell script to create a scheduled task in Windows 10 to do a Full scan every Wednesday at 12:00 PM # Define task name and command$taskName = "Microsoft Defender Full Scan"$command = "powershell.exe -ExecutionPolicy Bypass -Command Start-MpScan -ScanType FullScan"# Create a trigger for Wednesday at 12:00 PM$trigger = New-ScheduledTaskTrigger -Weekly -DaysOfWeek Wednesday -At 12pm# Create action to run the command$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument $command# Register the scheduled taskRegister-ScheduledTask -TaskName $taskName -Trigger $trigger -Action $action -Description "Runs a full antivirus scan using Microsoft Defender" -RunLevel Highest -Force

Bas_de_Bruijn MiSum83 I created a Powershell script for Intune distribution towards Windows 10 machines. as wel. # Start transcript for loggingStart-Transcript -Path "C:\Temp\Microsoft_Defender_TaskSc.txt" -Append# Set up variables for the full scan schedule$FullScanTrigger = New-ScheduledTaskTrigger -Weekly -DaysOfWeek Wednesday -At 12pm$FullScanAction = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument '-Command "& { Start-MpScan -ScanType FullScan }"'$FullScanSettings = @{TaskName = 'Windows Defender Full Scan'Trigger = $FullScanTriggerAction = $FullScanActionPrincipal = New-ScheduledTaskPrincipal -UserId "NT AUTHORITY\SYSTEM" -LogonType ServiceAccount}# Create the full scan scheduled taskRegister-ScheduledTask @FullScanSettings# Output redirection for errors$ErrorActionPreference = "Stop"$LogFile = "C:\Temp\Defender_Error_Log.txt"# Try block to catch errorstry {# Your script code here}catch {# Write error to log file$_.Exception.Message | Out-File -FilePath $LogFile -Append}# Stop transcriptStop-Transcript

I believe you are referring to report from Microsoft Defender's scan.In this case you have to check MEM Admin Center and under Endpoint Security and AntiVirus, you will see reports.Have a look at:https://techcommunity.microsoft.com/t5/intune-customer-success/announcing-new-endpoint-security-antivirus-reports/ba-p/1666326https://learn.microsoft.com/en-us/mem/intune/fundamentals/reports

Thanks for the links... I will use MEM admin Center then as my primary tool for it. And will monitor my testing devices for few days.Just to confirm - is my configuration OK then? I mean, "Scan Parameter" -FULL is connected to Thursday and 10 AM. And quick scan will run every day at 12 PM regardless what is configured in SCAN PARAMETER (full in my case)?

MiSum83 Did you manage to figure this one out ?I'm setting mine up at the moment, and am completely confused by the following settings in the Antivirus Policy:Scheduled Scan TimeScheduled Quick Scan TimeScan ParameterThe two schedule options both state this in the information section: "The scan type will depends(sic) on what scan type is selected in the Defender/ScanParameter setting" While "Scan Parameter" has options for QuickScan, and FullScan.... This makes having a spearate Quick scan schedule, and full scan schedule, superfluous at best, and nonsensical at worst.I'm about to do my own tests and decipher the same confusing settings hopefully, but if you have any light to shed on how these settings are meant to be configured to have both a QuickScan AND FullScan run on a schedule within the same policy, it would be much appreciated.

Intune + Defender - Configure Quick and Full scan

Reza_Ameri
Silver Contributor
Nov 15, 2022
I believe you are referring to report from Microsoft Defender's scan.
In this case you have to check MEM Admin Center and under Endpoint Security and AntiVirus, you will see reports.
Have a look at:
https://techcommunity.microsoft.com/t5/intune-customer-success/announcing-new-endpoint-security-antivirus-reports/ba-p/1666326
https://learn.microsoft.com/en-us/mem/intune/fundamentals/reports
- MiSum83
  Brass Contributor
  Nov 15, 2022
  Thanks for the links... I will use MEM admin Center then as my primary tool for it. And will monitor my testing devices for few days.
  
  Just to confirm - is my configuration OK then? I mean, "Scan Parameter" -FULL is connected to Thursday and 10 AM. And quick scan will run every day at 12 PM regardless what is configured in SCAN PARAMETER (full in my case)?
  - Greg_Brown
    Copper Contributor
    Jan 17, 2023
    MiSum83
    
    Did you manage to figure this one out ?
    
    I'm setting mine up at the moment, and am completely confused by the following settings in the Antivirus Policy:
    
    Scheduled Scan Time
    Scheduled Quick Scan Time
    Scan Parameter
    
    The two schedule options both state this in the information section: "The scan type will depends(sic) on what scan type is selected in the Defender/ScanParameter setting"
    
    While "Scan Parameter" has options for QuickScan, and FullScan.... This makes having a spearate Quick scan schedule, and full scan schedule, superfluous at best, and nonsensical at worst.
    
    I'm about to do my own tests and decipher the same confusing settings hopefully, but if you have any light to shed on how these settings are meant to be configured to have both a QuickScan AND FullScan run on a schedule within the same policy, it would be much appreciated.
Daniel_R1983735
Copper Contributor
Feb 09, 2023
MiSum83

can i again change it to block without having the problem again?

thank you in advance
VladanOEI
Copper Contributor
Nov 08, 2023
Hello,
I'm also totally confused with the Intune Antivirus options.
Scan Parameter - (Quick scan/Full scan/Not configured)
Schedule Quick Scan Time - Selects the time of day that the Windows Defender quick scan should run. Note The scan type will depends on what scan type is selected in the Defender/ScanParameter setting. For example, a value of 0=12:00AM, a value of 60=1:00AM, a value of 120=2:00, and so on, up to a value of 1380=11:00PM. The default value is 120
Schedule Scan Day - Selects the day that the Windows Defender scan should run. Note The scan type will depends on what scan type is selected in the Defender/ScanParameter setting.
Schedule Scan Time - Selects the time of day that the Windows Defender scan should run. Note The scan type will depends on what scan type is selected in the Defender/ScanParameter setting. For example, a value of 0=12:00AM, a value of 60=1:00AM, a value of 120=2:00, and so on, up to a value of 1380=11:00PM. The default value is 120.

If you have a QUICK scan time set aside (Schedule Quick Scan Time) doesn't it make sense that (Scan Parameter) ONLY has (Full Scan/Not Configured) as possible values?
If you have options to configure QUICK and FULL scans, doesn't it make sense to have two possible drop down boxes "Schedule Scan Day-QUICK" and "Schedule Scan Day-FULL"?

I have a very simple request:
1. Run a FAST scan at 9am every Tuesday
2. Run a FULL scan at 9am every Thursday
How to accomplish this using the current options within Intune Endpoint Security?

Thanks in advance,
- Greg_Brown
  Copper Contributor
  Nov 10, 2023
  VladanOEI
  
  This one was definitely confusing as hell. I ended up just testing it all myself to see how it behaved.
  
  The following settings relate to a single scan type of your choosing:
  "Scan Parameter" Choose Quick or Full
  "Schedule Scan Day" Choose Day
  Schedule Scan Time" Choose Time
  
  The following is it's own daily quick scan:
  "Schedule Quick Scan Time" Pick the time of day that your daily quick scan will run.
  
  If you want a quick scan only once a week, and a Full scan once a week as well, you'll need to apply TWO separate policies and use the following three settings in each policy:
  "Scan Parameter" Choose Quick or Full
  "Schedule Scan Day" Choose Day
  Schedule Scan Time" Choose Time
  
  This will give you a quick scan that only runs once a week in one policy, and a full scan that only runs once a week in the other policy.
  
  I understand this is dumb. But in saying that, the quick scans are not even noticable across my servers. I would advise just running a quick scan daily, and then a scheduled full scan once a week within a single policy.
  
  I hope this makes as much sense as possible on a subject that seems engineered to be confusing.
  - VladanOEI
    Copper Contributor
    Nov 10, 2023
    We did exactly what you suggested but it doesn't work 😞
    We made 2 rules.
    First rule:
    "Scan Parameter" : Quick
    "Schedule Scan Day" : Thru
    Schedule Scan Time" 9 AM
    Second rule:
    "Scan Parameter" : Full
    "Schedule Scan Day" : Fri
    Schedule Scan Time" 9 AM
    
    and Intune Antivirus did not run any of the configured tasks.
    
    Microsoft never knew how to make simple things work properly. They are able to build "towers and cities", something that others cannot, and then they "fall" on such simple things like this.

Forum Discussion

Intune + Defender - Configure Quick and Full scan

Share

Resources