Edit

Share via

Set-CMAntimalwarePolicy

Module:
ConfigurationManager Module

Configure settings for an endpoint protection antimalware policy.

Syntax

SetByName (Default) 

Set-CMAntimalwarePolicy
    -Name <String>
    [-Description <String>]
    [-NewName <String>]
    [-PassThru]
    [-Priority <PriorityChangeType>]
    [-DisableWildcardHandling]
    [-ForceWildcardHandling]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

SetDefinitionUpdatesSettingsByName 

Set-CMAntimalwarePolicy
    -Name <String>
    [-AddDefinitionUpdateFileShare <String[]>]
    [-CleanDefinitionUpdateFileShare]
    [-DefinitionUpdateFileShare <String[]>]
    [-EnableSignatureUpdateCatchup <Boolean>]
    [-FallbackOrder <FallbackOrderType[]>]
    [-FallbackToAlternateSourceHr <Int32>]
    [-PassThru]
    [-RemoveDefinitionUpdateFileShare <String[]>]
    [-SignatureUpdateHr <Int32>]
    [-SignatureUpdateTime <DateTime>]
    [-DisableWildcardHandling]
    [-ForceWildcardHandling]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

SetDefinitionUpdatesSettingsByValue 

Set-CMAntimalwarePolicy
    -InputObject <IResultObject>
    [-AddDefinitionUpdateFileShare <String[]>]
    [-CleanDefinitionUpdateFileShare]
    [-DefinitionUpdateFileShare <String[]>]
    [-EnableSignatureUpdateCatchup <Boolean>]
    [-FallbackOrder <FallbackOrderType[]>]
    [-FallbackToAlternateSourceHr <Int32>]
    [-PassThru]
    [-RemoveDefinitionUpdateFileShare <String[]>]
    [-SignatureUpdateHr <Int32>]
    [-SignatureUpdateTime <DateTime>]
    [-DisableWildcardHandling]
    [-ForceWildcardHandling]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

SetExclusionSettingsByName 

Set-CMAntimalwarePolicy
    -Name <String>
    [-AddExcludedFilePath <String[]>]
    [-AddExcludedFileType <String[]>]
    [-AddExcludedProcess <String[]>]
    [-CleanExcludedFilePath]
    [-CleanExcludedFileType]
    [-CleanExcludedProcess]
    [-ExcludeFilePath <String[]>]
    [-ExcludeFileType <String[]>]
    [-ExcludeProcess <String[]>]
    [-PassThru]
    [-RemoveExcludedFilePath <String[]>]
    [-RemoveExcludedFileType <String[]>]
    [-RemoveExcludedProcess <String[]>]
    [-DisableWildcardHandling]
    [-ForceWildcardHandling]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

SetExclusionSettingsByValue 

Set-CMAntimalwarePolicy
    -InputObject <IResultObject>
    [-AddExcludedFilePath <String[]>]
    [-AddExcludedFileType <String[]>]
    [-AddExcludedProcess <String[]>]
    [-CleanExcludedFilePath]
    [-CleanExcludedFileType]
    [-CleanExcludedProcess]
    [-ExcludeFilePath <String[]>]
    [-ExcludeFileType <String[]>]
    [-ExcludeProcess <String[]>]
    [-PassThru]
    [-RemoveExcludedFilePath <String[]>]
    [-RemoveExcludedFileType <String[]>]
    [-RemoveExcludedProcess <String[]>]
    [-DisableWildcardHandling]
    [-ForceWildcardHandling]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

SetThreatOverridesSettingsByName 

Set-CMAntimalwarePolicy
    -Name <String>
    [-AddThreat <Hashtable>]
    [-CleanThreat]
    [-OverrideAction <DefaultActionMediumAndLowType[]>]
    [-PassThru]
    [-RemoveThreat <String[]>]
    [-ThreatName <String[]>]
    [-DisableWildcardHandling]
    [-ForceWildcardHandling]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

SetThreatOverridesSettingsByValue 

Set-CMAntimalwarePolicy
    -InputObject <IResultObject>
    [-AddThreat <Hashtable>]
    [-CleanThreat]
    [-OverrideAction <DefaultActionMediumAndLowType[]>]
    [-PassThru]
    [-RemoveThreat <String[]>]
    [-ThreatName <String[]>]
    [-DisableWildcardHandling]
    [-ForceWildcardHandling]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

SetScanSettingsByName 

Set-CMAntimalwarePolicy
    -Name <String>
    [-AllowClientUserConfigLimitCpuUsage <Boolean>]
    [-FullScanNetworkDrive <Boolean>]
    [-PassThru]
    [-ScanArchive <Boolean>]
    [-ScanEmail <Boolean>]
    [-ScanNetworkDrive <Boolean>]
    [-ScanRemovableStorage <Boolean>]
    [-ScheduledScanUserControl <ScheduledScanUserControlType>]
    [-DisableWildcardHandling]
    [-ForceWildcardHandling]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

SetScanSettingsByValue 

Set-CMAntimalwarePolicy
    -InputObject <IResultObject>
    [-AllowClientUserConfigLimitCpuUsage <Boolean>]
    [-FullScanNetworkDrive <Boolean>]
    [-PassThru]
    [-ScanArchive <Boolean>]
    [-ScanEmail <Boolean>]
    [-ScanNetworkDrive <Boolean>]
    [-ScanRemovableStorage <Boolean>]
    [-ScheduledScanUserControl <ScheduledScanUserControlType>]
    [-DisableWildcardHandling]
    [-ForceWildcardHandling]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

SetRealtimeProtectionSettingsByName 

Set-CMAntimalwarePolicy
    -Name <String>
    [-AllowClientUserConfigRealTime <Boolean>]
    [-EnablePuaProtection <Boolean>]
    [-PuaProtection <PuaProtection>]
    [-EnableScriptScanning <Boolean>]
    [-MonitorFileProgramActivity <Boolean>]
    [-NetworkExploitProtection <Boolean>]
    [-PassThru]
    [-RealTimeProtectionOn <Boolean>]
    [-RealTimeScanOption <RealTimeScanOptionType>]
    [-ScanAllDownloaded <Boolean>]
    [-UseBehaviorMonitor <Boolean>]
    [-DisableWildcardHandling]
    [-ForceWildcardHandling]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

SetRealtimeProtectionSettingsByValue 

Set-CMAntimalwarePolicy
    -InputObject <IResultObject>
    [-AllowClientUserConfigRealTime <Boolean>]
    [-EnablePuaProtection <Boolean>]
    [-PuaProtection <PuaProtection>]
    [-EnableScriptScanning <Boolean>]
    [-MonitorFileProgramActivity <Boolean>]
    [-NetworkExploitProtection <Boolean>]
    [-PassThru]
    [-RealTimeProtectionOn <Boolean>]
    [-RealTimeScanOption <RealTimeScanOptionType>]
    [-ScanAllDownloaded <Boolean>]
    [-UseBehaviorMonitor <Boolean>]
    [-DisableWildcardHandling]
    [-ForceWildcardHandling]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

SetAdvancedSettingsByName 

Set-CMAntimalwarePolicy
    -Name <String>
    [-AllowClientUserConfigSampleSubmission <Boolean>]
    [-AllowDeleteQuarantineFileDaysModification <Boolean>]
    [-AllowExclusionModification <Boolean>]
    [-AllowUserViewHistory <Boolean>]
    [-CreateSystemRestorePointBeforeClean <Boolean>]
    [-DeleteQuarantineFileDays <Int32>]
    [-DisableClientUI <Boolean>]
    [-EnableAutoSampleSubmission <Boolean>]
    [-EnableReparsePointScanning <Boolean>]
    [-PassThru]
    [-RandomizeScheduledScanStartTime <Boolean>]
    [-ShowNotification <Boolean>]
    [-DisableWildcardHandling]
    [-ForceWildcardHandling]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

SetAdvancedSettingsByValue 

Set-CMAntimalwarePolicy
    -InputObject <IResultObject>
    [-AllowClientUserConfigSampleSubmission <Boolean>]
    [-AllowDeleteQuarantineFileDaysModification <Boolean>]
    [-AllowExclusionModification <Boolean>]
    [-AllowUserViewHistory <Boolean>]
    [-CreateSystemRestorePointBeforeClean <Boolean>]
    [-DeleteQuarantineFileDays <Int32>]
    [-DisableClientUI <Boolean>]
    [-EnableAutoSampleSubmission <Boolean>]
    [-EnableReparsePointScanning <Boolean>]
    [-PassThru]
    [-RandomizeScheduledScanStartTime <Boolean>]
    [-ShowNotification <Boolean>]
    [-DisableWildcardHandling]
    [-ForceWildcardHandling]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

SetMAPSSettingsByName 

Set-CMAntimalwarePolicy
    -Name <String>
    [-AllowMapsModification <Boolean>]
    [-CloudBlockLevel <CloudBlockLevelType>]
    [-ExtendedCloudCheckSec <Int32>]
    [-JoinSpyNet <JoinSpyNetType>]
    [-PassThru]
    [-DisableWildcardHandling]
    [-ForceWildcardHandling]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

SetMAPSSettingsByValue 

Set-CMAntimalwarePolicy
    -InputObject <IResultObject>
    [-AllowMapsModification <Boolean>]
    [-CloudBlockLevel <CloudBlockLevelType>]
    [-ExtendedCloudCheckSec <Int32>]
    [-JoinSpyNet <JoinSpyNetType>]
    [-PassThru]
    [-DisableWildcardHandling]
    [-ForceWildcardHandling]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

SetScheduledScanSettingsByName 

Set-CMAntimalwarePolicy
    -Name <String>
    [-CheckLatestDefinition <Boolean>]
    [-EnableCatchupScan <Boolean>]
    [-EnableQuickScan <Boolean>]
    [-EnableScheduledScan <Boolean>]
    [-LimitCpuUsage <Int32>]
    [-PassThru]
    [-QuickScanTime <DateTime>]
    [-ScanWhenClientNotInUse <Boolean>]
    [-ScheduledScanTime <DateTime>]
    [-ScheduledScanType <ScheduledScanType>]
    [-ScheduledScanWeekday <ScheduledScanWeekdayType>]
    [-DisableWildcardHandling]
    [-ForceWildcardHandling]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

SetScheduledScanSettingsByValue 

Set-CMAntimalwarePolicy
    -InputObject <IResultObject>
    [-CheckLatestDefinition <Boolean>]
    [-EnableCatchupScan <Boolean>]
    [-EnableQuickScan <Boolean>]
    [-EnableScheduledScan <Boolean>]
    [-LimitCpuUsage <Int32>]
    [-PassThru]
    [-QuickScanTime <DateTime>]
    [-ScanWhenClientNotInUse <Boolean>]
    [-ScheduledScanTime <DateTime>]
    [-ScheduledScanType <ScheduledScanType>]
    [-ScheduledScanWeekday <ScheduledScanWeekdayType>]
    [-DisableWildcardHandling]
    [-ForceWildcardHandling]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

SetDefaultActionSettingsByName 

Set-CMAntimalwarePolicy
    -Name <String>
    [-DefaultActionHigh <DefaultActionSevereAndHighType>]
    [-DefaultActionLow <DefaultActionMediumAndLowType>]
    [-DefaultActionMedium <DefaultActionMediumAndLowType>]
    [-DefaultActionSevere <DefaultActionSevereAndHighType>]
    [-PassThru]
    [-DisableWildcardHandling]
    [-ForceWildcardHandling]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

SetDefaultActionSettingsByValue 

Set-CMAntimalwarePolicy
    -InputObject <IResultObject>
    [-DefaultActionHigh <DefaultActionSevereAndHighType>]
    [-DefaultActionLow <DefaultActionMediumAndLowType>]
    [-DefaultActionMedium <DefaultActionMediumAndLowType>]
    [-DefaultActionSevere <DefaultActionSevereAndHighType>]
    [-PassThru]
    [-DisableWildcardHandling]
    [-ForceWildcardHandling]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

SetByValue 

Set-CMAntimalwarePolicy
    -InputObject <IResultObject>
    [-Description <String>]
    [-NewName <String>]
    [-PassThru]
    [-Priority <PriorityChangeType>]
    [-DisableWildcardHandling]
    [-ForceWildcardHandling]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

Description

The Set-CMAntiMalwarePolicy cmdlet configures settings for an endpoint protection antimalware policy.

First use New-CMAntimalwarePolicy to create the policy object. When you create the policy, use the Policy parameter to specify which types of settings the policy includes. If you use Set-CMAntiMalwarePolicy to configure settings for policy types that weren't originally added, it adds the types when you configure the settings.

For more information, see How to create and deploy antimalware policies for Endpoint Protection in Configuration Manager.

Note

Run Configuration Manager cmdlets from the Configuration Manager site drive, for example PS XYZ:\>. For more information, see getting started.

Examples

Example 1: Create an antimalware policy and enable PUA auditing

In this example, it first creates a new antimalware policy that includes the RealTimeProtection settings type. It then configures that policy to enable auditing for potentially unwanted applications (PUA).

$polName = "Real-time protection policy"
$polDesc = "via Pwsh by " + $env:UserName + " at " + $(Get-Date)
New-CMAntimalwarePolicy -Name $polName -Description $polDesc -Policy RealTimeProtection

Set-CMAntimalwarePolicy -Name $polName -PuaProtection Audit

Example 2: Increase the priority of an antimalware policy

This command increases the priority of the antimalware policy named ContosoPolicy.

Set-CMAntiMalwarePolicy -Name "ContosoPolicy" -Priority Increase

Parameters

-AddDefinitionUpdateFileShare

If you select UNC file shares as a security intelligence update source, use this parameter to add more network paths to the list.

Parameter properties

Type:

String[]

Default value:None
Supports wildcards:False
DontShow:False
Aliases:AddDefinitionUpdateFileSharesSources, AddDefinitionUpdateFileShares

Parameter sets

SetDefinitionUpdatesSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetDefinitionUpdatesSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-AddExcludedFilePath

Specify a file or folder path to exclude from antimalware scans. Exclusions can help scans complete faster or avoid conflicts with some applications. It can also increase the malware risk.

Use this parameter to add more paths to the list.

For example: %windir%\explorer.exe, %windir%\system32

Parameter properties

Type:

String[]

Default value:None
Supports wildcards:False
DontShow:False
Aliases:AddExcludedFilePaths

Parameter sets

SetExclusionSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetExclusionSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-AddExcludedFileType

Specify a file extension to exclude all files of this type from antimalware scans. Exclusions can help scans complete faster or avoid conflicts with some applications. It can also increase the malware risk.

Use this parameter to add more types to the list.

For example: .jpg, .txt

Parameter properties

Type:

String[]

Default value:None
Supports wildcards:False
DontShow:False
Aliases:AddExcludedFileTypes

Parameter sets

SetExclusionSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetExclusionSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-AddExcludedProcess

Specify the path to a process executable file to exclude it from antimalware scans. Exclusions can help scans complete faster or avoid conflicts with some applications. It can also increase the malware risk.

Use this parameter to add more processes to the list.

For example: %windir%\system32\service.exe

Parameter properties

Type:

String[]

Default value:None
Supports wildcards:False
DontShow:False
Aliases:AddExcludedProcesses

Parameter sets

SetExclusionSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetExclusionSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-AddThreat

Specify a hashtable of threat names and corresponding override action. This table defines remediation actions to take when the specified threat name is detected during a scan.

Use this parameter to add more threats to the list.

Parameter properties

Type:Hashtable
Default value:None
Supports wildcards:False
DontShow:False
Aliases:AddThreats

Parameter sets

SetThreatOverridesSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetThreatOverridesSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-AllowClientUserConfigLimitCpuUsage

Set this parameter to $true to allow users on client computers to configure CPU usage during scans.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetScanSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetScanSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-AllowClientUserConfigRealTime

Set this parameter to $true to allow users on client computers to configure real-time protection settings.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetRealtimeProtectionSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetRealtimeProtectionSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-AllowClientUserConfigSampleSubmission

Set this parameter to $true to allow users on client computers to modify auto sample file submission settings.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetAdvancedSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetAdvancedSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-AllowDeleteQuarantineFileDaysModification

Set this parameter to $true to allow users on client computers to configure the setting for quarantined file deletion.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False
Aliases:AllowUserConfigQuarantinedFileDeletionPeriod

Parameter sets

SetAdvancedSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetAdvancedSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-AllowExclusionModification

Set this parameter to $true to allow users on client computers to exclude files and folders, file types, and processes from scans.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False
Aliases:AllowUserAddExcludes

Parameter sets

SetAdvancedSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetAdvancedSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-AllowMapsModification

Set this parameter to $true to allow users on client computers to modify Cloud Protection Service settings.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False
Aliases:AllowUserChangeSpyNetSettings

Parameter sets

SetMAPSSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetMAPSSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-AllowUserViewHistory

Set this parameter to $true to allow all users on client computers to view the full history results.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetAdvancedSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetAdvancedSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-CheckLatestDefinition

Set this parameter to $true to check for the latest security intelligence updates before running a scan.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetScheduledScanSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetScheduledScanSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-CleanDefinitionUpdateFileShare

Add this parameter to remove the list of network file shares to use as security intelligence update sources.

Parameter properties

Type:SwitchParameter
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetDefinitionUpdatesSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetDefinitionUpdatesSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-CleanExcludedFilePath

Add this parameter to remove the list of file paths to exclude from scans.

Parameter properties

Type:SwitchParameter
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetExclusionSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetExclusionSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-CleanExcludedFileType

Add this parameter to remove the list of file extensions to exclude from scans.

Parameter properties

Type:SwitchParameter
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetExclusionSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetExclusionSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-CleanExcludedProcess

Add this parameter to remove the list of processes to exclude from scans.

Parameter properties

Type:SwitchParameter
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetExclusionSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetExclusionSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-CleanThreat

Add this parameter to remove the table of predefined remediation actions for detected threat names.

Parameter properties

Type:SwitchParameter
Default value:None
Supports wildcards:False
DontShow:False
Aliases:CleanThreats

Parameter sets

SetThreatOverridesSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetThreatOverridesSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-CloudBlockLevel

For the Cloud Protection Service, specify the level of blocking suspicious files.

Parameter properties

Type:CloudBlockLevelType
Default value:None
Accepted values:Normal, High, HighExtraProtection, BlockUnknown
Supports wildcards:False
DontShow:False

Parameter sets

SetMAPSSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetMAPSSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-Confirm

Prompts you for confirmation before running the cmdlet.

Parameter properties

Type:SwitchParameter
Default value:False
Supports wildcards:False
DontShow:False
Aliases:cf

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-CreateSystemRestorePointBeforeClean

Set this parameter to $true to create a system restore point before computers are cleaned.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetAdvancedSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetAdvancedSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-DefaultActionHigh

Specify the default action that endpoint protection takes in response to a threat it classifies at the High level.

Parameter properties

Type:DefaultActionSevereAndHighType
Default value:None
Accepted values:Recommended, Quarantine, Remove
Supports wildcards:False
DontShow:False

Parameter sets

SetDefaultActionSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetDefaultActionSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-DefaultActionLow

Specify the default action that endpoint protection takes in response to a threat it classifies at the Low level.

Parameter properties

Type:DefaultActionMediumAndLowType
Default value:None
Accepted values:None, Quarantine, Remove, Allow
Supports wildcards:False
DontShow:False

Parameter sets

SetDefaultActionSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetDefaultActionSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-DefaultActionMedium

Specify the default action that endpoint protection takes in response to a threat it classifies at the Medium level.

Parameter properties

Type:DefaultActionMediumAndLowType
Default value:None
Accepted values:None, Quarantine, Remove, Allow
Supports wildcards:False
DontShow:False

Parameter sets

SetDefaultActionSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetDefaultActionSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-DefaultActionSevere

Specify the default action that endpoint protection takes in response to a threat it classifies at the Severe level.

Parameter properties

Type:DefaultActionSevereAndHighType
Default value:None
Accepted values:Recommended, Quarantine, Remove
Supports wildcards:False
DontShow:False

Parameter sets

SetDefaultActionSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetDefaultActionSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-DefinitionUpdateFileShare

Specify an array of UNC file share sources used to download security intelligence updates. Sources are contacted in the order specified.

If you specify this parameter, the client contacts the provided resources for updates. Once the client successfully downloads updates from one source, it doesn't contact the remaining sources in the list. If you don't specify this parameter, the list remains empty and no sources are contacted.

Parameter properties

Type:

String[]

Default value:None
Supports wildcards:False
DontShow:False
Aliases:DefinitionUpdateFileSharesSources, DefinitionUpdateFileShares

Parameter sets

SetDefinitionUpdatesSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetDefinitionUpdatesSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-DeleteQuarantineFileDays

Specify the number of days that items should be kept in the Quarantine folder before being removed.

If you specify this parameter, items are removed from the Quarantine folder after the specified number of days. If you don't specify this parameter, items are kept in the Quarantine folder for the number of days specified in the default policy, which is 30 days.

Parameter properties

Type:Int32
Default value:None
Supports wildcards:False
DontShow:False
Aliases:DeleteQuarantinedFilesPeriod

Parameter sets

SetAdvancedSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetAdvancedSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-Description

Specify an optional description for the antimalware policy to help you identify it.

Parameter properties

Type:String
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-DisableClientUI

Set this parameter to $true to disable the client user interface.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetAdvancedSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetAdvancedSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-DisableWildcardHandling

This parameter treats wildcard characters as literal character values. You can't combine it with ForceWildcardHandling.

Parameter properties

Type:SwitchParameter
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-EnableAutoSampleSubmission

Set this parameter to $true to enable auto sample file submission. This feature helps Microsoft determine whether certain detected items are malicious.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetAdvancedSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetAdvancedSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-EnableCatchupScan

Set this parameter to $true to force a scan of the selected scan type if a client computer is offline during two or more scheduled scans.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetScheduledScanSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetScheduledScanSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-EnablePuaProtection

In version 2103 or earlier, set this parameter to $true to enable detection for potentially unwanted applications (PUA).

Starting in version 2107, use the PuaProtection parameter to configure this setting.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetRealtimeProtectionSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetRealtimeProtectionSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-EnableQuickScan

Set this parameter to $true to run a daily quick scan on client computers.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False
Aliases:EnableQuickDailyScan

Parameter sets

SetScheduledScanSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetScheduledScanSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-EnableReparsePointScanning

Set this parameter to $true to enable reparse point scanning.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetAdvancedSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetAdvancedSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-EnableScheduledScan

Set this parameter to $true to configure this policy to run a scheduled scan on client computers.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetScheduledScanSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetScheduledScanSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-EnableScriptScanning

Set this parameter to $true to enable script scanning.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetRealtimeProtectionSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetRealtimeProtectionSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-EnableSignatureUpdateCatchup

Set this parameter to $true to force a security intelligence update if the client computer is offline for more than two consecutive scheduled updates.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False
Aliases:EnableSignatureUpdateCatchupInterval

Parameter sets

SetDefinitionUpdatesSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetDefinitionUpdatesSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-ExcludeFilePath

Specify an array of file paths for which scheduled and real-time scanning is disabled.

Parameter properties

Type:

String[]

Default value:None
Supports wildcards:False
DontShow:False
Aliases:ExcludedFilePaths, ExcludeFilePaths

Parameter sets

SetExclusionSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetExclusionSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-ExcludeFileType

Specify an array of file types to exclude from scheduled and real-time scanning.

Parameter properties

Type:

String[]

Default value:None
Supports wildcards:False
DontShow:False
Aliases:ExcludedFileTypes, ExcludeFileTypes

Parameter sets

SetExclusionSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetExclusionSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-ExcludeProcess

Specify an array of processes for which any files opened by any of the processes are excluded from scheduled and real-time scanning. The process itself is not excluded.

Parameter properties

Type:

String[]

Default value:None
Supports wildcards:False
DontShow:False
Aliases:ExcludedProcesses, ExcludeProcesses

Parameter sets

SetExclusionSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetExclusionSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-ExtendedCloudCheckSec

Specify the number of seconds to allow an extended check with the Cloud Protection Service to block and scan suspicious files.

Parameter properties

Type:Int32
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetMAPSSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetMAPSSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-FallbackOrder

Define which security intelligence update sources the client uses, and the order in which it contacts them.

Parameter properties

Type:

FallbackOrderType[]

Default value:None
Accepted values:UpdatesDistributedFromConfigurationManager, UpdatesFromUncFileShares, UpdatesDistributedFromWsus, UpdatesDistributedFromMicrosoftUpdate, UpdatesDistributedFromMicrosoftMalwareProtectionCenter
Supports wildcards:False
DontShow:False

Parameter sets

SetDefinitionUpdatesSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetDefinitionUpdatesSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-FallbackToAlternateSourceHr

If you use Configuration Manager as a source for security intelligence updates, clients will only update from alternative sources if security intelligence is older than the number of hours that you specify with this value.

Parameter properties

Type:Int32
Default value:None
Supports wildcards:False
DontShow:False
Aliases:AuGracePeriod, FallbackToAlternateSourceHour

Parameter sets

SetDefinitionUpdatesSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetDefinitionUpdatesSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-ForceWildcardHandling

This parameter processes wildcard characters and may lead to unexpected behavior (not recommended). You can't combine it with DisableWildcardHandling.

Parameter properties

Type:SwitchParameter
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-FullScanNetworkDrive

Set this parameter to $true to scan mapped network drives when running a full scan.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False
Aliases:FullScanNetworkDrives

Parameter sets

SetScanSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetScanSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-InputObject

Specify an antimalware policy object to configure. To get this object, use the Get-CMAntiMalwarePolicy cmdlet.

Parameter properties

Type:IResultObject
Default value:None
Supports wildcards:False
DontShow:False
Aliases:AntiMalwarePolicy

Parameter sets

SetDefinitionUpdatesSettingsByValue
Position:Named
Mandatory:True
Value from pipeline:True
Value from pipeline by property name:False
Value from remaining arguments:False
SetExclusionSettingsByValue
Position:Named
Mandatory:True
Value from pipeline:True
Value from pipeline by property name:False
Value from remaining arguments:False
SetThreatOverridesSettingsByValue
Position:Named
Mandatory:True
Value from pipeline:True
Value from pipeline by property name:False
Value from remaining arguments:False
SetScanSettingsByValue
Position:Named
Mandatory:True
Value from pipeline:True
Value from pipeline by property name:False
Value from remaining arguments:False
SetRealtimeProtectionSettingsByValue
Position:Named
Mandatory:True
Value from pipeline:True
Value from pipeline by property name:False
Value from remaining arguments:False
SetAdvancedSettingsByValue
Position:Named
Mandatory:True
Value from pipeline:True
Value from pipeline by property name:False
Value from remaining arguments:False
SetMAPSSettingsByValue
Position:Named
Mandatory:True
Value from pipeline:True
Value from pipeline by property name:False
Value from remaining arguments:False
SetScheduledScanSettingsByValue
Position:Named
Mandatory:True
Value from pipeline:True
Value from pipeline by property name:False
Value from remaining arguments:False
SetDefaultActionSettingsByValue
Position:Named
Mandatory:True
Value from pipeline:True
Value from pipeline by property name:False
Value from remaining arguments:False
SetByValue
Position:Named
Mandatory:True
Value from pipeline:True
Value from pipeline by property name:False
Value from remaining arguments:False

-JoinSpyNet

Specify the Cloud Protection Service membership type.

  • DoNotJoinMaps: No information is sent.
  • BasicMembership: Collect and send lists of detected malware.
  • AdvancedMembership: Basic information and more comprehensive information that could contain personal information. For example, file paths and partial memory dumps.

Parameter properties

Type:JoinSpyNetType
Default value:None
Accepted values:DoNotJoinMaps, BasicMembership, AdvancedMembership
Supports wildcards:False
DontShow:False

Parameter sets

SetMAPSSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetMAPSSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-LimitCpuUsage

Specify the percentage to limit CPU usage during scans.

Parameter properties

Type:Int32
Default value:None
Accepted values:0, 10, 20, 30, 40, 50, 60, 70, 80, 90
Supports wildcards:False
DontShow:False

Parameter sets

SetScheduledScanSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetScheduledScanSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-MonitorFileProgramActivity

Set this parameter to $true to monitor file and program activity on the client computer.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetRealtimeProtectionSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetRealtimeProtectionSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-Name

Specify the name of an antimalware policy to configure.

Parameter properties

Type:String
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetByName
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetDefinitionUpdatesSettingsByName
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetExclusionSettingsByName
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetThreatOverridesSettingsByName
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetScanSettingsByName
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetRealtimeProtectionSettingsByName
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetAdvancedSettingsByName
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetMAPSSettingsByName
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetScheduledScanSettingsByName
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetDefaultActionSettingsByName
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-NetworkExploitProtection

Set this parameter to $true to enable protection against network-based exploits.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False
Aliases:NetworkProtectionAgainstExploits

Parameter sets

SetRealtimeProtectionSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetRealtimeProtectionSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-NewName

Use this parameter to rename the policy that you specify with either the Name or InputObject parameters.

Parameter properties

Type:String
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-OverrideAction

Specify the threat override action. Use this parameter with the ThreatName parameter to configure threat override settings.

Parameter properties

Type:

DefaultActionMediumAndLowType[]

Default value:None
Accepted values:None, Quarantine, Remove, Allow
Supports wildcards:False
DontShow:False
Aliases:OverrideActions

Parameter sets

SetThreatOverridesSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetThreatOverridesSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-PassThru

Add this parameter to return an object that represents the item with which you're working. By default, this cmdlet may not generate any output.

Parameter properties

Type:SwitchParameter
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-Priority

Use this parameter to change the priority of the antimalware policy.

Parameter properties

Type:PriorityChangeType
Default value:None
Accepted values:Increase, Decrease
Supports wildcards:False
DontShow:False

Parameter sets

SetByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-PuaProtection

Starting in version 2107, use this parameter to configure detection for potentially unwanted applications (PUA). Specify one of the following values: Disable, Enable, or Audit

Parameter properties

Type:PuaProtection
Default value:None
Accepted values:Disable, Enable, Audit
Supports wildcards:False
DontShow:False

Parameter sets

SetRealtimeProtectionSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetRealtimeProtectionSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-QuickScanTime

Specify a datetime object for when to do a daily quick scan. To get this object, use the Get-Date built-in cmdlet.

Parameter properties

Type:DateTime
Default value:None
Supports wildcards:False
DontShow:False
Aliases:ScheduledScanQuickTime

Parameter sets

SetScheduledScanSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetScheduledScanSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-RandomizeScheduledScanStartTime

Set this parameter to $true to randomize scheduled scan and security intelligence update start times.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetAdvancedSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetAdvancedSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-RealTimeProtectionOn

Set this parameter to $true to enable real-time protection.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetRealtimeProtectionSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetRealtimeProtectionSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-RealTimeScanOption

Specify how real-time protection scans system files. For performance reasons, you might have to change the default value if a server has high incoming or outgoing file activity.

Parameter properties

Type:RealTimeScanOptionType
Default value:None
Accepted values:ScanIncomingAndOutgoingFiles, ScanIncomingFilesOnly, ScanOutgoingFilesOnly
Supports wildcards:False
DontShow:False

Parameter sets

SetRealtimeProtectionSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetRealtimeProtectionSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-RemoveDefinitionUpdateFileShare

Specify the network file share paths to remove from the list. To clear the entire list, use the CleanDefinitionUpdateFileShare parameter.

Parameter properties

Type:

String[]

Default value:None
Supports wildcards:False
DontShow:False
Aliases:RemoveDefinitionUpdateFileSharesSources, RemoveDefinitionUpdateFileShares

Parameter sets

SetDefinitionUpdatesSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetDefinitionUpdatesSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-RemoveExcludedFilePath

Specify the excluded file paths to remove from the list. To clear the entire list, use the CleanExcludedFilePath parameter.

Parameter properties

Type:

String[]

Default value:None
Supports wildcards:False
DontShow:False
Aliases:RemoveExcludedFilePaths

Parameter sets

SetExclusionSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetExclusionSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-RemoveExcludedFileType

Specify the excluded file types to remove from the list. To clear the entire list, use the CleanExcludedFileType parameter.

Parameter properties

Type:

String[]

Default value:None
Supports wildcards:False
DontShow:False
Aliases:RemoveExcludedFileTypes

Parameter sets

SetExclusionSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetExclusionSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-RemoveExcludedProcess

Specify the excluded processes to remove from the list. To clear the entire list, use the CleanExcludedProcesses parameter.

Parameter properties

Type:

String[]

Default value:None
Supports wildcards:False
DontShow:False
Aliases:RemoveExcludedProcesses

Parameter sets

SetExclusionSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetExclusionSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-RemoveThreat

Specify the names of threats to remove from the threat override table.

Parameter properties

Type:

String[]

Default value:None
Supports wildcards:False
DontShow:False
Aliases:RemoveThreats, RemoveThreatsByName

Parameter sets

SetThreatOverridesSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetThreatOverridesSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-ScanAllDownloaded

Set this parameter to $true to scan all downloaded files and enable exploit protection for the browser.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetRealtimeProtectionSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetRealtimeProtectionSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-ScanArchive

Set this parameter to $true to scan archived files, for example .zip or .cab files.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False
Aliases:ScanArchivedFiles

Parameter sets

SetScanSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetScanSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-ScanEmail

Set this parameter to $true to scan email and email attachments.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetScanSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetScanSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-ScanNetworkDrive

Set this parameter to $true to scan network files.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False
Aliases:ScanNetworkDrives

Parameter sets

SetScanSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetScanSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-ScanRemovableStorage

Set this parameter to $true to scan removable storage devices such as USB drives.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetScanSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetScanSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-ScanWhenClientNotInUse

Set this parameter to $true to start a scheduled scan only when the computer is idle.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetScheduledScanSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetScheduledScanSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-ScheduledScanTime

Specify a datetime object for when to do a scheduled scan. To get this object, use the Get-Date built-in cmdlet.

Parameter properties

Type:DateTime
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetScheduledScanSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetScheduledScanSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-ScheduledScanType

Specify the type of a scheduled scan.

  • QuickScan: This type of scan checks the in-memory processes and folders where malware is typically found. It requires fewer resources than a full scan.

  • FullScan: This type of scan adds a full check of all local files and folders to the items scanned in the quick scan. This scan takes longer than a quick scan and uses more CPU processing and memory resources on client computers.

In most cases, use Quick scan to minimize the use of system resources on client computers. If malware removal requires a full scan, endpoint protection generates an alert that's displayed in the Configuration Manager console. The default value is Quick scan.

Parameter properties

Type:ScheduledScanType
Default value:None
Accepted values:None, QuickScan, FullScan
Supports wildcards:False
DontShow:False

Parameter sets

SetScheduledScanSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetScheduledScanSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-ScheduledScanUserControl

Specify the user control of scheduled scans.

Parameter properties

Type:ScheduledScanUserControlType
Default value:None
Accepted values:NoControl, ScanTimeOnly, FullControl
Supports wildcards:False
DontShow:False

Parameter sets

SetScanSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetScanSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-ScheduledScanWeekday

Specify the day of the week when a scheduled scan runs.

Parameter properties

Type:ScheduledScanWeekdayType
Default value:None
Accepted values:Daily, Sunday, Monday, Tuesday, Wednesday, Thursday, Friday, Saturday
Supports wildcards:False
DontShow:False

Parameter sets

SetScheduledScanSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetScheduledScanSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-ShowNotification

Set this parameter to $true to show notifications on the client computer when the user needs to run a full scan, update security intelligence, or run Windows Defender Offline.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False
Aliases:ShowNotificationMessages

Parameter sets

SetAdvancedSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetAdvancedSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-SignatureUpdateHr

Specify the interval of hours between checks for security intelligence updates. Use an integer value up to 24, for example:

  • 0: Disable check on interval
  • 1: Check for updates every hour
  • 24: Check once per day

Parameter properties

Type:Int32
Default value:None
Supports wildcards:False
DontShow:False
Aliases:SignatureUpdateInterval, SignatureUpdateIntervalHour

Parameter sets

SetDefinitionUpdatesSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetDefinitionUpdatesSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-SignatureUpdateTime

Specify a datetime object for when the client checks for security intelligence updates each day. To get this object, use the Get-Date built-in cmdlet.

This setting only applies if you disable interval-based checks with -SignatureUpdateHr 0.

Parameter properties

Type:DateTime
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetDefinitionUpdatesSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetDefinitionUpdatesSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-ThreatName

Specify the name of a threat. Use this parameter with the OverrideAction parameter to configure threat override settings.

Parameter properties

Type:

String[]

Default value:None
Supports wildcards:False
DontShow:False
Aliases:ThreatNames

Parameter sets

SetThreatOverridesSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetThreatOverridesSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-UseBehaviorMonitor

Set this parameter to $true to enable behavior monitoring.

Parameter properties

Type:Boolean
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

SetRealtimeProtectionSettingsByName
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False
SetRealtimeProtectionSettingsByValue
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-WhatIf

Shows what would happen if the cmdlet runs. The cmdlet doesn't run.

Parameter properties

Type:SwitchParameter
Default value:False
Supports wildcards:False
DontShow:False
Aliases:wi

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

Inputs

Microsoft.ConfigurationManagement.ManagementProvider.IResultObject

Outputs

System.Object