Windows 10: Windows Defender Default Behavior

Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational:

 

Looked in there and saw only the event from 2 days ago. After reading hundreds of posts, it seems that this a quite common that the auto scan doesn't work. I think I will just go back to Mcafee or something else.

 

In Task Scheduler navigate to
Task Scheduler Library > Microsoft > Windows > Windows Defender
You should see the built in WD Scan task

In Task Scheduler, Enable All Tasks History

After All Tasks History is enabled, you can look at the History tab of any task to see a log
You may need to wait hours/day to see the WD scan log info you want

 

I enabled all tasks history like you said. In the top window, it DID show a scan yesterday that I was not aware of. In the other window under history, there is nothing. Are you saying that this history could take a while to populate?

 

Yes, but Defender's definition of an 'opportune time' is when NO other activity is taking place. The automatic Defender scan is set to abort on any activity - even a mouse click can count as 'activity'. For the reassurance of a regular daily scan, set a scheduled task in addition to the automatic one - either that or leave the system running but unused for a while.

 

No, i just meant you might have to wait a while before the task auto runs again, as soon as it runs the info should be in the History tab

I don't know what the other window under history logs and shows.

I didn't like the way the WD built in scan worked so i got rid of that task, i can't really test it unless i get that task back

 

So David, in that top window where it showed a scan ran yesterday - that doesn't correlate with the "scan details" note at the bottom of the Defender App page. Does the note on the Defender page just pertain to a manual scan maybe???

 

I don't know, i would hope the Windows logs/info do correlate and show the same info
I got rid of the built in WD scan task, so i can't verify that

I created my own WD scan task to run the way i want
For me, the Scheduled Task History and what is displayed in the WD GUI do match
So, it's not just a manual scan displayed in the WD GUI window for me

 

thanks. I will watch that log for a couple days and see what happens. I guess the problem for me, and others I'm sure, is that it is not real comforting thinking Defender will protect you when basics like seeing and scheduling scans are so confusing and questionable. I will post back in a day or so.

 

OK, good luck with that
Maybe someone else using WD and the built in task can check and see if things match
You could also do a manual "Run" on that task to see how things look after it finishes

 

OP back again. I watched for a couple days and the log DOES show that it's auto-scanning once daily, so I will call it good. The notification on the Defender screen only seems to pertain to the last MANUAL scan so it can be misleading. Thanks everyone.