The last set of cmdlets I'm going to talk about today deal with
controlling the Windows Defender tool that comes as standard
protection for Windows operating systems now.
Before I jump into the demo though,
here are the cmdlets I find most useful and a little background on what they do.
The Get‑MpPreference and Set‑MpPreference cmdlets allow you to
check and set the configuration of the tool,
while the Get‑MpComputerStatus will show you the current status of all the
functionality that falls underneath the Defender umbrella.
Defender does have Signatures for the antivirus that
should be updated automatically.
If you need to run a pull manually for some reason,
you can use the Update‑MpSignature.
Once everything is set,
a Start‑MpScan can be called with a ScanType parameter
that will run the type of scan requested.
Defender will take steps to mitigate, but may question items in the quarantine.
If you are set on deleting everything,
running the Remove‑MpThreat will permanently delete any
quarantined items not already removed.
All right, one of our last demos of the course.
Let's jump right in.
We're going to take a look at Microsoft Defender and
how to use PowerShell to control it.
We're going to be able to look at our status.
We'll look at our configurations or our preferences.
We're going to be able to set preferences,
and then look at how to update Signatures,
and kickoff scans.
So one of the first things we're going to do is look at the status,
when is the last time a scan ran.
When was the last time a QuickScan, a FullScan.
When's the last time our Signature files updated?
All that information is right in here.
So I could see the last time a QuickScan ran,
it'll actually tell me when/if it's overdue.
That's something you might want to flag on.
So if it shows that the QuickScan is overdue or if I go
up here that the FullScan is overdue, we can flag on that,
throw it into our Cim, and alert to say,
hey, we haven't ran a FullScan here in a while.
Here's the last Signature file that was used during a scan.
And then, if you scroll up a little bit,
you can see what the current Signature file is.
If we're way off on this, that's something we really need to be notified on.
So next, we're going to look at, okay, we looked at the status of stuff,
what's the configuration?
What are our settings?
When do we want to run scans?
One of the things here at the top are all these disabled fields.
This is everything it's doing and not doing.
So looking at some of these True items, the True means that it's not doing it.
So we're not doing a CatchupFullScan.
We're not doing email scanning.
We're not doing removable drive scanning.
Some of that might be important.
If we have people who have laptops and they're on the road with them.
If they're plugging in USB drives,
if we don't have any type of way of monitoring or blocking that,
if that's within our policies to say it's okay that you use removable drives,
right?
If it's a business decision to say, hey,
we need to use removable drives for whatever reason,
we probably want to scan those when they get plugged in.
So one of the things we're going to talk about next
is how do we set that preference.
But first, before we get to that, one last item here is another Get‑MpPreference,
but this time, with this CimSession.
So this is how you connect to the domain‑connected remote systems and
look at these settings and change these settings.
Demos that we go through today, if you simply add the ‑CimSession,
you're going to be able to connect to a remote
computer and run all these same commands.
So next thing we're going to look at is the Set Preference.
But unfortunately, because I'm running this within Visual Studio Code,
I'm not going to be able to run this because I
don't have the correct permissions.
But to change one of these settings,
you basically just grab the setting that you want to change
and apply the change you want to make.
Here I have 0 for False, but I can also just type in the $False same way.
Keep in mind, you're not doing an equal sign,
you're doing simply what the setting is you want to change and
what the value is you want to set it to.
I have another one here for changing the QuickTimeScan.
If I go down to ScanScheduleQuickScanTime,
I should see right now it's set to midnight.
The 0's may actually say that it's not set at all,
so this might be actually setting a time to run a QuickScan.
All right, a few of the last items that we want to look at,
let's comment this back out, we're going to look at Update‑MpSignature.
So this is how you force an update.
So if you don't think you're on the latest version,
if there's a critical patch that's come out,
something that's happened, you can force an update of the MpSignature.
When I run this, it's going to simply just run.
You'll see in the bottom right there that the clock is spinning.
So I'm going to pause this video and come back when this
is done and show you what happens.
All right, when it finishes, you'll see it just comes back to the prompt again.
Now if you scroll up, the last time you ran this,
it showed, I actually have to go up a little bit farther,
it showed an AntiVirusSignature of 1.383.440.0.
So now when we go back, let me comment this out,
and we'll go back and get our status again.
Run it.
Go up to the AntivirusSignature, we got 1.383.453.0.
So it updated it.
So a very quick command that you can run to update on the fly whenever you
need your Signatures for your antivirus and antispyware.
So the last thing I want to walk through the Start‑MpScan.
So this is how you actually kick off a scan,
and then you set it to what type of scan you want.
So, in this case, I want to select a QuickScan.
So I just set it, ScanType of QuickScan, and I can run it.
All right, so I kicked off the scan.
This is probably going to take a few minutes.
So we're going to wrap up this demo just talking
about if I want to run a FullScan,
I just simply change it from a ScanType of QuickScan to ScanType of FullScan.
And again, if I use that CimSession,
I can then select which computer I want to run this on,
and I can run it across my network.
It doesn't have to be just on the local machine.