Forum Discussion
"Run Antivirus Scan" results in "Antivirus scan failed"
JuliusPIV thank you!!
you can review the event viewer on the device itself by checking the below events.
You can also trigger a full scan from MDE as well as below and monitor the timeline logs.
JuliusPIV did you check the device page from the MDE device blade? and in the timeline section you can check the logs to see if the AV scan is completed
.
Hey there elieelkarkafi! Thanks for taking the time to reply and congratulations on the MVP nomination! :party_popper:🥳
The timeline doesn't show a full scan having completed today which is curious as I started looking into this several hours ago.
The 'Device health status' also doesn't show today's date for the last full scan:
I find that interesting as I tried to trigger a scan via Intune which completed without error:
We're 100% in the cloud so remote access is limited, but I tried to trigger a scan via mpcmdrun.exe which presumably worked because, when I run Start-MPScan it fails immediately with "start-mpscan : A scan is already in progress on this device." Curiously the FullScanStartTime property from Get-MPComputerStatus returns a September 16, not today which doesn't instill much confidence that a scan is indeed in progress.
Is there a sure fire way to verify that a full scan is indeed underway and there isn't a deeper problem? Are there any logs I can review to see what Defender is up to?
JuliusPIV thank you!!
you can review the event viewer on the device itself by checking the below events.
You can also trigger a full scan from MDE as well as below and monitor the timeline logs.
Thanks again! We are indeed triggering the full scan from the M365 Security portal. In the http://Thanks%20again! We are indeed triggering the full scan from the M365 Security portal. If you check the first/original post I have screenshots showing that After scheduling it the Action Center window appears & confirms the scan is scheduled/queued. However, after a few minutes when revisiting the Action Center it shows the scan I have screenshots showing:
- After triggering a scan, the Action Center window appears & confirms a scan is pending.
- However, after a few minutes when revisiting the Action Center again it now shows the scan failed
Awesome tip regarding the Event logs. I'll do what I can remotely & see what comes back. Thanks again!
- After much waiting another day or two this issue went away. Perhaps a scan was indeed running but with extremely limited access to the machine (physical or otherwise) it was challenging to verify this.