locked
malfunctioning windows defender or task scheduler: action center pop ups displaying scan results for scans that did not occur RRS feed

  • Question

  • On this computer the windows defender scan functions properly in quick and full mode but there are problems with the scheduling.

    The scheduling is producing errors.

    The errors are displayed by false reports in the action center.

    In the image below when looking at the windows defender image it displays last scan today at 2:07 PM.  It was a full scan.

    In the action center it displays recent windows defender scan results at 2:07:04.  This result indicates that the windows defender scan results as displayed on windows defender.

    The problem display in the action center though is the pop up message that appeared at 7:20 PM today indicating that it made 5 additional scans.

    In task scheduler for Microsoft Antimalware this is the XML file information Triggers at 12:19 AM every Sunday of every week, starting 1/1/2000 - Trigger expires at 1/1/2100 12:00:00 AM.  Next run time 4/2/2017 12:19:30 AM     Last run time 3/26/2017 12:19:30 AM    Last Run Result:  The system cannot find the file specified (0x80070002)

    In task scheduler for Windows Defender:

    In the task scheduler is displays that it scanned today at 7:20 PM.  This is the same time which appears in the action center indicating that 5 scans were performed.  And the Windows defender software displayed that no scan was performed since 2:07 PM.

    The task scheduler had been modified to troubleshoot Windows defender scans displaying error codes.  Those error codes have disappeared.  The problem now are the action center pop ups displaying numerous Windows defender scan when windows defender made no scans.

    How do you troubleshoot and fix the task scheduler, action center, and windows defender so that the action center displays only the actual windows defender scan that were displayed in windows defender and not the extra scans that did not really occur?

    Sunday, April 2, 2017 1:31 AM

All replies

  • Thank you for letting us know, I have passed this information to the Windows Defender AV team (This forum is for the WDATP - Advanced Threat Protection service) and they will follow up.
    Saturday, April 8, 2017 4:17 PM
  • Thank you for contacting Microsoft with your inquiry.  If you still having issues with action center pop up messages, please obtain MPSupportFiles.cab from the affected machine and email it to mmpcres@microsoft.com.  Please follow the steps below to obtain MPSupportFiles.cab:

    From elevated command prompt:

    C:\Program Files\Windows Defender\mpcmdrun -getfiles

    Once we receive your files, we will investigate and reply to you.

    Regards,

    MMPC Customer Response

    Tuesday, April 18, 2017 3:40 AM
  • The command was not recognized as an internal or external command:

    Microsoft Windows [Version 10.0.14393]
    (c) 2016 Microsoft Corporation. All rights reserved.
    C:\windows\system32>C:\Program Files\Windows Defender\mpcmdrun -getfiles
    'C:\Program' is not recognized as an internal or external command,
    operable program or batch file.
    C:\windows\system32>

    Tuesday, April 18, 2017 5:40 AM
  • This method was found to generate the cab file:

    cd\ <enter>

    cd program files <enter>

    cd Microsoft security client <enter> (Windows Vista/Windows 7) -or-

    cd Windows Defender <enter> (Windows 8.x or Windows 10)
    MpCmdRun -getfiles <enter>

    However the folder for the cab files that was created today was not found using file explorer or everything search.

    I was only able to find the files using administrative command prompt notepad.  However it was not readable within notepad.

    There are old files on the computer named mpsupportfiles.cab that were found in file explorer but the new files were not found.

    Are they hidden?  If so how are they found and saved to send as an attachment?

    On another computer it does not display a date modified and clicking to open displayed:  windows cannot access the specified device, path, or file.  You may not have the appropriate permissions to access the item.

    I was able to the find and open the file using administrative command prompt notepad.  It is not readable in notepad though.

    How do you get permissions and then find and open the proper file ?

    How do you save the file and save as attachment unless you have permission?

    Tuesday, April 18, 2017 7:18 AM