Launching a Windows Defender Offline Scan with Configuration Manager 2012 OSD

re: Launching a Windows Defender Offline Scan with Configuration Manager 2012 OSD

Nash — Sun, 21 Apr 2013 00:16:18 GMT

Thanks for this write-up, Jason. Why isn't this a built-in feature?

re: Launching a Windows Defender Offline Scan with Configuration Manager 2012 OSD

Jim — Thu, 14 Feb 2013 16:35:44 GMT

@Ryan: i have finally upgraded to sccm 2012 sp1 and can confirm the links posted here work like a charm.

@Jason: are there any command line parameters for the offlinescannershell.exe ?

I would love to update the definitions in the task sequence.

re: Launching a Windows Defender Offline Scan with Configuration Manager 2012 OSD

Ryan — Wed, 30 Jan 2013 15:39:16 GMT

Jason

Now that Configmgr 2012 SP1 has been released are the links for SP1 still valid or is there newer content I should be searching for? I had this solution in place for RTM and now want to update it.

Thanks for the great post!

re: Launching a Windows Defender Offline Scan with Configuration Manager 2012 OSD

James T Bennett — Fri, 26 Oct 2012 14:50:22 GMT

This is just what we need, Thanks for providing it.

I have everything set up like you posted but I am having some trouble.

If I use the command line like this:

"%ProgramFiles%\Microsoft Security Client\OfflineScannerShell.exe" /autoscan

It gets stuck on on the screen above your last picture…it looks like it is searching for something.

If I move the Quote to the other side of the /autoscan switch like this…

"%ProgramFiles%\Microsoft Security Client\OfflineScannerShell.exe /autoscan”

Then the quick scan runs but never closes, and when I manually close it I get a Task Sequence error.

Also I have looked and not been able to find any switches that would let me run a Full Scan instead of a Quick Scan.

I have tried “MpCmdRun.exe –Scan –Scan Type 2” but that fails too

Thanks for your help,

James

re: Launching a Windows Defender Offline Scan with Configuration Manager 2012 OSD

Jim — Mon, 15 Oct 2012 08:32:42 GMT

Hello, i was not able to perform a successfull scan with the old wim files. I set up a lab environment for cm 2012 sp1 and ran successfull scans for both x86 and x64. However the instruction renaming the file for x64 seems to be wrong. The scan did not start with the filename changed to mpam-fex64.exe, i renamed it to mpam-fe.exe and it worked like a charm.

re: Launching a Windows Defender Offline Scan with Configuration Manager 2012 OSD

Jim — Fri, 05 Oct 2012 18:33:14 GMT

Hello Jason, thanks again for your effort. I was able to import the wim file. However, when running the task sequence Offline defender starts but exits with exit code 2152730626. I've copied the latest definition files to the root directory of the wim file and verified it's renamed to mpam-fex64.exe.

When i try launching the offlinescannershell.exe from the command line it tells me my definition files are not up to date, when i hit update it seems like defender is downloading new definitions and starts the scan.

I was unable to find out if and where a new definition file could have been written. I've also tried applying the update with mpam-fex64.exe -q but i'm getting "The subsystem needed to support the image type is not present." error message.

I've double checked, prior to posting, i've followed all your steps. Im going to try a 32-bit version of the wim file to see if the above problem applys there as well.

re: Launching a Windows Defender Offline Scan with Configuration Manager 2012 OSD

Jason Githens — Wed, 03 Oct 2012 13:51:40 GMT

The links have been updated to provide WIMs for both ConfigMgr 2012 RTM, and ConfigMgr 2012 SP1 Beta. Please post if you have any further issues.

Thanks,

Jason Githens - Microsoft - Configuration Manager

re: Launching a Windows Defender Offline Scan with Configuration Manager 2012 OSD

Jason Githens — Mon, 01 Oct 2012 20:31:16 GMT

Thanks for the feedback. Unfortunately, the link is now pointing to the WIM supported only in CM12 SP1, and we're working on adding a link to the CM12 RTM WIM. We hope to have this resolved in the next couple of days.

Thanks,

Jason Githens

Microsoft - Configuration Manager

re: Launching a Windows Defender Offline Scan with Configuration Manager 2012 OSD

April — Mon, 01 Oct 2012 18:29:23 GMT

Hi Jim,

Thank you for responding. I hope someone can post a link to the Windows 7 based WIM file so I can import into SCCM 2012. Any article I come across references the Windows 8 based iso image.

Thank You

re: Launching a Windows Defender Offline Scan with Configuration Manager 2012 OSD

Jim — Fri, 28 Sep 2012 09:56:48 GMT

I think this is because the windows offline defender pxe image is now based on windows 8 which is not supported by sccm 2012 rtm (sccm2012 sp1 should resolve this).

One would need an older defender image still using windows 7 pe. Plus you need to add WinPE-Scripting.cab and WinPE-WMI.cab to you boot.wim prior to importing it into sccm.

technet.microsoft.com/.../bb680372.aspx

I've performed these steps with the new cabs from the windows 8 adk but i fails giving me the finalized error, which leads me to the conclusion at the begining of my post. Can anyone clarify this ?