Check Windows Defender status
Documentation: Microsoft Learn
Get-MpComputerStatus returns the live state of the Defender engine as a single object.
The script
Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
Get-MpComputerStatus | Select-Object AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled,AntivirusSignatureVersion- Stage 1Get-MpComputerStatus
Positional values or no named parameters - Stage 2Select-Object
Positional values or no named parameters
How it works
Get-MpComputerStatus returns the live state of the Defender engine as a single object. Select-Object pulls the four fields that answer the question directly: whether the antimalware service is up, whether antivirus protection is enabled, whether real-time scanning is active, and which signature version is currently loaded.
Adapting it
Substitute AntivirusSignatureLastUpdated or QuickScanEndTime into the property list when the concern is scan freshness rather than configuration state.
Requirements
The Windows Defender feature must be present; some Server Core installs omit it.
If the result is unexpected
Get-MpComputerStatus errors with a message about the operation being unavailable, or it returns flags suggesting healthy protection on a machine where a third-party product is doing the scanning.
The Defender cmdlets ship with the Defender feature, so a Server Core installation without that feature has no cmdlet to call. Where a third-party antivirus registers with the Security Center, Defender drops into passive mode and its own flags keep reporting on its state rather than on whether anything is protecting the machine.
- Confirm the module is present with Get-Module -ListAvailable Defender.
- Check Get-Service WinDefend, since a disabled service accounts for the operation error.
- Read AMRunningMode, which distinguishes normal mode from passive and EDR block mode.
- Query the registered antivirus products through the SecurityCenter2 namespace to see what is actually in charge.
- Install the feature with Install-WindowsFeature Windows-Defender if this host is meant to be using it.
Validate the result
AMRunningMode reports Normal on hosts where Defender is the intended product, and the SecurityCenter2 query lists it as the registered provider.
Keep the check reliable
Check AMRunningMode instead of the enabled flags in any compliance report, because those flags stay true in passive mode.
