PowerShell: Check Windows Defender Status
Need a quick health check on Windows Defender - confirming it's active, up to date, and actually protecting the machine right now? This one-liner pulls the key status indicators straight from the system.
Prerequisites:
- Privileges: None
- Module: Built-in, no import needed
Quick Command:
Get-MpComputerStatus | Select-Object AntivirusEnabled, RealTimeProtectionEnabled, AntivirusSignatureAge, IsTamperProtectedExample Output:
AntivirusEnabled RealTimeProtectionEnabled AntivirusSignatureAge IsTamperProtected
---------------- ------------------------- --------------------- -----------------
True True 0 True📦
Want all of them at once?
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.
How It Works:
- Get-MpComputerStatus returns a full status report from Windows Defender, covering everything from engine versions to scan history - around 50 properties in total, far more than needed for a quick check.
- AntivirusEnabled confirms Defender is active as the antivirus solution on the machine.
- RealTimeProtectionEnabled checks specifically whether ongoing, real-time scanning is active - this can be disabled independently of the antivirus being "enabled" overall.
- AntivirusSignatureAge shows how many days old the virus definitions are - 0 means updated today; a higher number signals outdated signatures and a potential security gap.
- IsTamperProtected shows whether Tamper Protection is blocking unauthorized attempts (by malware or a user) to disable Defender's protections.