Forum Discussion
Scheduled Scans with Defender AV with ATP
Good afternoon. I'm working on migrating our company over to Microsoft Defender AV with Defender ATP as ATP is included in our E5 license. Is there any guidance regarding running scheduled AV scans...
Scheduled scans are all but obsolete now that most good malware is polymorphic and obfuscates itself to evade traditional virus definitions. If real-time protection is enabled, then in theory a scheduled scan shouldn't be needed other than upon first installation to verify the prior disk contents (because real-time protection will scan all new added content).
So a weekly scan is probably fine but I wouldn't recommend daily - the risk/reward ratio just isn't there when you consider the CPU overhead costs of scans. This is just my opinion.
Here is where you can find those settings using GPO, PowerShell, Intune or MEM
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus
So a weekly scan is probably fine but I wouldn't recommend daily - the risk/reward ratio just isn't there when you consider the CPU overhead costs of scans. This is just my opinion.
Here is where you can find those settings using GPO, PowerShell, Intune or MEM
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus
- Joe, Thanks for your reply. I think we are going to go ahead and not have scheduled scans in place. I'm not sure if you know the answer to this question or not but I'm using this documentation when working on our Anti-Malware policy https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus What I'm trying to find the answer to is why the settings under the Reporting, Network Inspection, and Root section of the Windows Defender Antivirus are being marked as Not Used? Are these settings not supported anymore? An example would be "Configure Watson Events"
- According to the MSFT Documentation team, (I opened a ticket in Github to confirm), it means the documentation article has not yet been created. Notice how all the other items have articles in that same column.
