Ultra Fast Antivirus Software TotalAV Antivirus is a free to use antivirus packed with all the essential features to find & remove malware keeping you safe. Rapid install and keeps you protected without slowing you down; Keep gaming, image and video editing and other resource-intensive activities. The Windows Defender Antivirus is installed by default on all devices running Windows 10. While it is a good option for conducting basic virus scans, it does not offer complete protection. When tested by IT security experts, the default windows antivirus didn't perform as well as other antivirus software, often failing to block malware. Download TotalAV free antivirus software 2021. Stay 100% safe from malware and viruses with TotalAV free antivirus protection.
-->Important
The improved Microsoft 365 security center is now available in public preview. This new experience brings Defender for Endpoint, Defender for Office 365, Microsoft 365 Defender, and more into the Microsoft 365 security center. Learn what's new. This topic might apply to both Microsoft Defender for Endpoint and Microsoft 365 Defender. Refer to the Applies To section and look for specific call outs in this article where there might be differences.
Applies to:
Microsoft Defender Antivirus lets you define how long an endpoint can avoid an update or how many scans it can miss before it is required to update and scan itself. This is especially useful in environments where devices are not often connected to a corporate or external network, or devices that are not used on a daily basis.
For example, an employee that uses a particular PC is on break for three days and does not log on to their PC during that time.
When the user returns to work and logs on to their PC, Microsoft Defender Antivirus will immediately check and download the latest protection updates, and run a scan.
Set up catch-up protection updates for endpoints that haven't updated for a while
If Microsoft Defender Antivirus did not download protection updates for a specified period, you can set it up to automatically check and download the latest update at the next log on. This is useful if you have globally disabled automatic update downloads on startup.
Use Configuration Manager to configure catch-up protection updates
On your Microsoft Endpoint Manager console, open the antimalware policy you want to change (click Assets and Compliance in the navigation pane on the left, then expand the tree to Overview > Endpoint Protection > Antimalware Policies)
Go to the Security intelligence updates section and configure the following settings:
- Set Force a security intelligence update if the client computer is offline for more than two consecutive scheduled updates to Yes.
- For the If Configuration Manager is used as a source for security intelligence updates..., specify the hours before which the protection updates delivered by Configuration Manager should be considered out-of-date. This will cause the next update location to be used, based on the defined fallback source order.
Click OK.
Deploy the updated policy as usual.
Use Group Policy to enable and configure the catch-up update feature
On your Group Policy management computer, open the Group Policy Management Console, right-click the Group Policy Object you want to configure and click Edit.
In the Group Policy Management Editor go to Computer configuration.
Click Policies then Administrative templates.
Expand the tree to Windows components > Microsoft Defender Antivirus > Signature Updates.
Double-click the Define the number of days after which a catch-up security intelligence update is required setting and set the option to Enabled. Enter the number of days after which you want Microsoft Defender AV to check for and download the latest protection update.
Click OK.
Use PowerShell cmdlets to configure catch-up protection updates
Use the following cmdlets:
See Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus and Defender cmdlets for more information on how to use PowerShell with Microsoft Defender Antivirus.
Antivirus X-out
Use Windows Management Instruction (WMI) to configure catch-up protection updates
Use the Set method of the MSFT_MpPreference class for the following properties:
See the following for more information and allowed parameters:
See the following for more information and allowed parameters:
Set the number of days before protection is reported as out-of-date
You can also specify the number of days after which Microsoft Defender Antivirus protection is considered old or out-of-date. After the specified number of days, the client will report itself as out-of-date, and show an error to the user of the PC. It may also cause Microsoft Defender Antivirus to attempt to download an update from other sources (based on the defined fallback source order), such as when using MMPC as a secondary source after setting WSUS or Microsoft Update as the first source.
Use Group Policy to specify the number of days before protection is considered out-of-date
On your Group Policy management machine, open the Group Policy Management Console, right-click the Group Policy Object you want to configure and click Edit.
In the Group Policy Management Editor go to Computer configuration.
Click Policies then Administrative templates.
Expand the tree to Windows components > Microsoft Defender Antivirus > Signature Updates and configure the following settings:
Double-click Define the number of days before spyware definitions are considered out of date and set the option to Enabled. Enter the number of days after which you want Microsoft Defender AV to consider spyware Security intelligence to be out-of-date.
Click OK.
Double-click Define the number of days before virus definitions are considered out of date and set the option to Enabled. Enter the number of days after which you want Microsoft Defender AV to consider virus Security intelligence to be out-of-date.
Click OK.
Set up catch-up scans for endpoints that have not been scanned for a while
You can set the number of consecutive scheduled scans that can be missed before Microsoft Defender Antivirus will force a scan.
The process for enabling this feature is:
- Set up at least one scheduled scan (see the Schedule scans topic).
- Enable the catch-up scan feature.
- Define the number of scans that can be skipped before a catch-up scan occurs.
This feature can be enabled for both full and quick scans.
Use Group Policy to enable and configure the catch-up scan feature
Ensure you have set up at least one scheduled scan.
On your Group Policy management machine, open the Group Policy Management Console, right-click the Group Policy Object you want to configure and click Edit.
In the Group Policy Management Editor go to Computer configuration.
Click Policies then Administrative templates.
Expand the tree to Windows components > Microsoft Defender Antivirus > Scan and configure the following settings:
- If you have set up scheduled quick scans, double-click the Turn on catch-up quick scan setting and set the option to Enabled.
- If you have set up scheduled full scans, double-click the Turn on catch-up full scan setting and set the option to Enabled. Click OK.
- Double-click the Define the number of days after which a catch-up scan is forced setting and set the option to Enabled.
- Enter the number of scans that can be missed before a scan will be automatically run when the user next logs on to the PC. The type of scan that is run is determined by the Specify the scan type to use for a scheduled scan (see the Schedule scans topic). Click OK.
Antivirus X Out Reviews
Note
The Group Policy setting title refers to the number of days. The setting, however, is applied to the number of scans (not days) before the catch-up scan will be run.
Use PowerShell cmdlets to configure catch-up scans
Use the following cmdlets:
See Use PowerShell cmdlets to manage Microsoft Defender Antivirus and Defender cmdlets for more information on how to use PowerShell with Microsoft Defender Antivirus.
Use Windows Management Instruction (WMI) to configure catch-up scans
Use the Set method of the MSFT_MpPreference class for the following properties:
See the following for more information and allowed parameters:
Use Configuration Manager to configure catch-up scans
On your Microsoft Endpoint Manager console, open the antimalware policy you want to change (click Assets and Compliance in the navigation pane on the left, then expand the tree to Overview > Endpoint Protection > Antimalware Policies)
Go to the Scheduled scans section and Force a scan of the selected scan type if client computer is offline... to Yes.
Click OK.
Deploy the updated policy as usual.
Related articles
