Windows 10: Windows Defender Scheduled Scan returns result 0x2

Hi. There are 4 Windows Defender Scheduled Tasks. All but the periodic scan task result in successful completions (0x0). The Scheduled Periodic scan task results return 0x2. This holds true even if I run the task on demand. I've found that by disabling Real Time Protection then rebooting the machine causes the task to run successfully 1 or 2 times after which the problem occurs again. This holds true on 2 computers (1 laptop and 1 desktop). Some time ago I created my own Windows Defender scheduled scan to run once a week which runs flawlessly. The built in task starts a program in C:\ProgramData\Microsoft\Windows Defender\platform\4.16.17656.18052-0\MpCmdRun.exe Scan - ScheduleJob - ScanTrigger 55. The task I created starts a program in "C:\ProgramFiles\Windows Defender\MpCmdRun.exe" -Scan - Scan Type 1. When my task runs a Command Prompt window shows while scanning while the built in scan runs in the background. Has anyone else noticed a problem with the built in Periodic scan task? Again as mentioned earlier, the other 3 built in Defender Scheduled tasks run without any problem.
Thanks.

:)

 

Windows Defender Default Scheduled Task - Looking For Information


I'm looking for some information.
If your on 1703, using Windows Defender and it's Default Scheduled Scan.
The Last Run Results always shows 0x2 (Failed) ... no matter how the action is run (automatic or manual)
Could you check your Windows Credentials / Generic Credentials and see if your PCNAME\USERNAME is listed ?

I've got two pcs Desktop & Laptop (1703 - 15063.332)
Desktop
Windows Defender / Default Scheduled Scan always shows Last Run Results of 0x2 (Failed) ... no matter how the action is run (automatic or manual)
Windows Credentials / Generic Credentials - PCNAME\USERNAME - NOT LISTED.
Note: I added the PCNAME\USERNAME and now the Last Run Results is showing 0x0 (Successful)
Note: I couldn't even open Command Prompt as Admin and run the command without if failing, now I can.
"C:\Program Files\Windows Defender\MpCmdRun.exe" Scan -ScheduleJob -ScanTrigger 55

Laptop
Windows Defender / Default Scheduled Scan always shows Last Run Results of 0x0 (Successful) ... no matter how the action is run (automatic or manual)
Windows Credentials / Generic Credentials - PCNAME\USERNAME - LISTED.

Task Scheduler Library / Microsoft / Windows / Windows Defender
Windows Defender Schedules Scan / Actions - C:\Program Files\Windows Defender\MpCmdRun.exe Scan -ScheduleJob -ScanTrigger 55

 

defender scans

Hi Ian,

Thanks for posting your query on Microsoft Community.

This issue might occur if you have set any task scheduler for Windows Defender.

I suggest you to delete the task for Windows defender and check if it helps.

Follow the below steps:

• 
  Search and open Schedule tasks.
  
• 
  In the left-hand menu, open the Task Scheduler Library, then select
  Microsoft >Windows >Windows Defender.
  
• 
  Double-click Windows Defender Scheduled Scan.
  
• 
  Select the Triggers panel, then select Delete.
  

Hope it helps, reply to us with the status of your issue. We will be happy to assist you.

 

What are scheduled Windows Defender quick scans supposed to accomplish?

Upon installing Windows 10, I found that, by default, the Windows Task Scheduler runs a daily WD quick scan:

%ProgramFiles%\Windows Defender\MpCmdRun.exe Scan -ScheduleJob

(FYI, the task can be found under Task Scheduler Library > Microsoft > Windows > Windows Defender)

That's nice, but what happens when the scan finds a problem? Specifically, in my Task Scheduler, I'm seeing that the "Last Run Result" is listed as "0x2". That (if I'm reading the MpCmdRun help file correctly) means malware was found, right?

So where do I go for the details about the malware found, and/or the action taken? I see three possible options:

1) That the offending malware would appear in the Windows Defender GUI's "History" tab --> Nope, it doesn't.

2) That the Event Viewer would display entries related to the malware detection (under Event Viewer (Local) > Applications and Services > Microsoft > Windows > Windows Defender) --> Nope, no events were created as a result of the scheduled quick scan -- not
even "scan started", "scan finished" events -- although I can see that events were created earlier, as a result of manual (via the WD GUI) scans that I did.

3) That SOMETHING would appear in the WD log files (which you get from MpSupportFiles.cab) --> Nope, all entries here precede the scheduled scan that just took place.

(Note: For anyone interested in options 2 and 3 above, the information on how to get this info is available in FAQ item #22 on Windows Defender on Windows 8 - Introduction and Frequently Asked Questions
).

So, to put it succinctly:

a) Am I correct in assuming that a "Last Run Result" of "0x2" indicates malware found?

b) If so, what action was taken by WD?

c) If any action was indeed taken, how do I determine what it was?

Thanks!