Windows 10: Where are the -ScheduleJob, -ScanTrigger, and -IdleScheduled Job options for MpCmdRun.exe...

In the MpCmdRun.exe documentation https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/command-line-arguments-microsoft-defender-antivirus, the command-line options -ScheduleJob, -ScanTrigger, and -IdleScheduledJob are not documented. In the standard Windows Defender Schedule Scan task in Task Scheduler in Windows 10, these three undocumented options are used in the scheduled task's command line:C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23110.3-0\MpCmdRun.exe Scan -ScheduleJob -ScanTrigger 55 -IdleScheduledJobI found this by running the following command a

:)

 

Windows Defender Taskplaner Job "Windows Defender Scheduled Scan" Error 0x80508018

Hello, I searched the complete Internet ;-) , but I found no good answer:

Why does the task ""C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2211.5-0\MpCmdRun.exe" Scan -ScheduleJob -ScanTrigger 55 always reports the error 0x80508018. The main problem is the undocumented option "Scantrigger 55". Without this option, the task works. If I change the option to "Scantrigger 50" the task works as well (other values 21, 22 .. work as well, )

So the main question is : What does the undocumented option "Scantrigger 55" exactly do ?

Regards Dietmar

 

MpCmdRun killing my internet connection after installing creators update

Hi Brian,

The MpCmdRun.exe is associated with the Windows Defender program and is located in
C:\Program Files\Windows Defender. There are malicious programs that uses the same name so you won't suspect that it is malware. To check if this process is a malicious program, you can follow these steps:

• Right-click Start and select Task Manager.
• Under the Process tab, locate the MpCmdRun.
• Right-click MpCmdRun and select Open file location.

If the location is C:\Program Files\Windows Defender, then the system is safe and secure. If the location is elsewhere then we suggest that you run a virus and malware scan on your computer.

Let us know if you have any other questions.

 

MpCmdRun file "SpyNetService -RestrictPrivileges -AccessKey..........

Hi,
[am using windows 8.1]
my laptop used to be continuously unable to update Defender after using the system restore [used restore to an earlier time to be able to update defender,as this proiblem occurs regardless] and then updating Defender,if i try again on another day i would get a message that defender wasnt allowed to update the virus signatures, have forgotten the "reason" in the msg.
Now, i am having a look at the "MpCmdRun" file that is in the windows/temp folder,as the laptop developed a problem at the same time as the windows defender problem above,where i am not able to delete certain files and folders in the windows/temp folder,such as the MpCmdRun files and the Crashpad folder with its files it contains,unless i take ownership of it [have to do this every time i want to delete these files].
I suspected malware.

And NOW there are entries in the MpCmdRun file:
"MpCmdRun: Command Line: "C:\Program Files\Windows Defender\MpCmdRun.exe" SpyNetService -RestrictPrivileges -AccessKey..............."

DO I HAVE SPYWARE ON MY LAPTOP?

HAVE MULTIPLE ENTRIES like the above as well as the below :
MpCmdRun: Command Line: "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges"

BUT now i am able to update defender,which i havent been able to do for a long time,unless i reformat the laptop or i use system restore ..........?!

Could anyone shed some light or have more info on this??

THANKS in advance

regards