configuration-management-reference-microsoft-defender-antivirus.md

title	description	ms.service	ms.localizationpriority	author	ms.author	ms.custom	ms.date	ms.reviewer	manager	ms.subservice	ms.topic	ms.collection	search.appverid
Manage Microsoft Defender Antivirus in your business	Learn how to use Group Policy, Configuration Manager, PowerShell, WMI, Intune, and the command line to manage Microsoft Defender Antivirus	defender-endpoint	medium	emmwalshh	ewalsh	nextgen	03/26/2025	yongrhee	deniseb	ngp	conceptual	m365-security tier2 mde-ngp	met150

Manage Microsoft Defender Antivirus in your business

[!INCLUDE Microsoft Defender XDR rebranding]

Applies to:

• Microsoft Defender for Endpoint Plan 1
• Microsoft Defender for Endpoint Plan 2
• Microsoft Defender XDR
• Microsoft Defender Antivirus

Platforms

• Windows
• Windows Server

Tip

For the best experience, please choose 1 method for configuring the Microsoft Defender Antivirus policies.

Important

Group Policy (GPO) wins over Microsoft Configuration Manager wins over Microsoft Intune wins over Microsoft Defender for Endpoint Security Configuration Management or Powershell or WMI or MpCmdRun.exe. You can manage and configure Microsoft Defender Antivirus with the following tools:

• Microsoft Defender for Endpoint Security Configuration Management
• Microsoft Intune
• Microsoft Configuration Manager
• Group Policy
• PowerShell cmdlets
• Windows Management Instrumentation (WMI)
• The Microsoft Malware Protection Command Line Utility (referred to as the mpcmdrun.exe utility)

The following articles provide further information, links, and resources for using these tools to manage and configure Microsoft Defender Antivirus.

Article	Description
Manage Microsoft Defender Antivirus with Microsoft Defender for Endpoint Security Configuration Management	Information about using the Microsoft Defender for Endpoint Security Configuration Management to configure, manage, and report, Microsoft Defender Antivirus
Manage Microsoft Defender Antivirus with Microsoft Intune and Microsoft Endpoint Configuration Manager	Information about using Intune and Configuration Manager to deploy, manage, report, and configure Microsoft Defender Antivirus
Manage Microsoft Defender Antivirus with Group Policy settings	List of all Group Policy settings located in ADMX templates
Manage Microsoft Defender Antivirus with PowerShell cmdlets	Instructions for using PowerShell cmdlets to manage Microsoft Defender Antivirus, plus links to documentation for all cmdlets and allowed parameters
Manage Microsoft Defender Antivirus with Windows Management Instrumentation (WMI)	Instructions for using WMI to manage Microsoft Defender Antivirus, plus links to documentation for the WMIv2 APIs (including all classes, methods, and properties)
Manage Microsoft Defender Antivirus with the MpCmdRun.exe command-line tool	Instructions on using the dedicated command-line tool to manage and use Microsoft Defender Antivirus

If running high CPU in Antimalware Service Executable | Microsoft Defender Antivirus Service | MsMpEng.exe, please review:

• Performance analyzer for Microsoft Defender Antivirus

Tip

If you're looking for Antivirus related information for other platforms, see:

• Set preferences for Microsoft Defender for Endpoint on macOS
• Microsoft Defender for Endpoint on Mac
• macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune
• Set preferences for Microsoft Defender for Endpoint on Linux
• Microsoft Defender for Endpoint on Linux
• Configure Defender for Endpoint on Android features
• Configure Microsoft Defender for Endpoint on iOS features [!INCLUDE Microsoft Defender for Endpoint Tech Community]