Lesson 18 — Antivirus Scan and Remediation Actions
Microsoft Defender for Endpoint allows authorised analysts to remotely initiate Microsoft Defender Antivirus scans on supported devices as part of an investigation or response.
A quick scan examines common threat locations with lower operational impact, while a full scan performs a broader inspection and can require considerably more time and system resources.
This lesson explains when to use each scan type, how Defender Antivirus remediates detections, how to monitor the response action and why a completed scan must still be followed by validation and threat hunting.
What you will learn
This lesson explains how antivirus scans support endpoint remediation and how analysts validate the result.
Learning objectives
After completing this lesson, you should be able to use antivirus scan actions as part of a controlled endpoint response.
- Explain the difference between quick and full scans.
- Select a scan type based on risk and operational impact.
- Start and monitor a remote antivirus scan.
- Understand common remediation outcomes.
- Validate that threats and persistence have been addressed.
The problem this solves
A Defender alert may identify malware or suspicious activity, but the endpoint can contain additional files or related threats that have not yet produced an alert.
An on-demand antivirus scan provides another inspection and remediation action while the analyst continues investigating the device and wider incident.
What is a remote antivirus scan?
A remote antivirus scan is a Microsoft Defender for Endpoint response action that instructs Microsoft Defender Antivirus to scan a supported device.
From the device page, an authorised analyst can select an available scan type, enter a comment and track the resulting action through the Action center.
Use scans to support the investigation. Do not replace incident analysis with a single scan result.
Quick scan
A quick scan focuses on areas where threats commonly establish or execute.
- Typically faster than a full scan.
- Lower performance and operational impact.
- Useful for initial triage and common malware locations.
- Appropriate when rapid inspection is required.
- Does not inspect every accessible file.
Full scan
A full scan performs a broader inspection of files and running activity available to Microsoft Defender Antivirus.
- More comprehensive than a quick scan.
- Can take significantly longer to complete.
- Can increase CPU, disk and operational load.
- Useful for confirmed or high-confidence compromise.
- Requires planning on critical or heavily used systems.
Quick scan compared with full scan
| Consideration | Quick scan | Full scan |
|---|---|---|
| Coverage | Common malware locations and active areas. | Broader inspection of accessible files and running activity. |
| Time | Usually completes more quickly. | Can take considerably longer. |
| Resource impact | Generally lower. | Potentially higher CPU and disk use. |
| Typical use | Initial response, triage or routine validation. | Confirmed compromise, deeper inspection or follow-up validation. |
When to start with a quick scan
- The alert requires immediate low-impact triage.
- The device is actively used by a business user.
- The evidence points to common malware locations.
- A broad scan is not yet operationally justified.
- The quick scan is one step in a larger response workflow.
When a full scan may be justified
- Malware compromise is confirmed.
- A quick scan found or remediated threats.
- Additional malicious files may remain elsewhere.
- The device has been isolated and impact is controlled.
- The incident response plan calls for broader inspection.
Before running the scan
- Confirm the correct device and associated incident.
- Review alerts, timeline, users and existing remediation.
- Determine whether evidence should be collected first.
- Decide whether device isolation is required.
- Check Microsoft Defender Antivirus health and security intelligence status.
- Assess the operational impact of a full scan.
- Record the reason and expected outcome.
Start the scan
Open the relevant device page in the Microsoft Defender portal and select Run antivirus scan from the available response actions.
Select the appropriate scan type, enter a clear comment and confirm the action.
Monitor the action
The scan action can be tracked through the device action history and the Action center.
Review whether the action is pending, in progress, completed or failed. A submitted request should never be assumed to have run successfully.
Scan workflow
Remediation outcomes
When Microsoft Defender Antivirus detects a threat, it attempts to take the remediation action configured for that detection and policy.
Depending on the threat and configuration, an item may be quarantined, removed, blocked, allowed, require further action or produce another security status that analysts must review.
Quarantine
Quarantine restricts a detected item so it cannot continue normal execution or access.
Restoring an item can reintroduce risk. Only restore a quarantined file after validating that it is a genuine false positive and following the organisation's approval process.
Do not confuse action status with threat status
| Status being reviewed | What it tells you | What it does not prove |
|---|---|---|
| Scan action completed | The endpoint completed the requested scan action. | That every malicious behaviour or persistence mechanism was removed. |
| Threat quarantined | A detected item was placed into quarantine. | That the attacker did not create additional files, accounts or persistence. |
| No threats found | The scan did not identify malware matching available detection logic. | That the device was never compromised or is currently trustworthy. |
Pending or long-running scans
A device may be offline, busy or unable to receive the action immediately. A full scan can also require substantial time.
Check device connectivity, health, action time and scan type before deciding whether the action is delayed or requires troubleshooting.
Failed scans
A failed scan must be investigated rather than ignored.
Review the action details, Defender Antivirus state, platform support, device health and relevant endpoint logs, then document whether another collection or remediation method was used.
How to validate remediation
- Confirm the scan action completed successfully.
- Review Defender Antivirus detections and remediation results.
- Confirm quarantined or removed items match the investigation.
- Review the device timeline after the scan.
- Hunt for the file hash, process, command line, domain and IP address.
- Check scheduled tasks, services, startup entries and other persistence.
- Investigate affected identities and reset compromised credentials.
- Confirm no related activity appears on other devices.
Update before rescanning
Security intelligence should be current so Microsoft Defender Antivirus can use the latest available detections.
If the endpoint has stale intelligence or health problems, resolve those conditions before relying on the result of another scan.
Critical servers and production devices
A full scan can create operational impact on high-load servers, specialised systems and production endpoints.
Coordinate with the system owner, review maintenance requirements and use the organisation's change and incident processes before initiating a resource-intensive action.
Example investigation workflow
Removing the file is not the same as removing the attacker. Always investigate how the payload arrived, what executed it and what else changed.
Scan results and identity compromise
Antivirus scanning focuses on endpoint threats. It does not reverse stolen passwords, session tokens, OAuth consent or cloud persistence.
Where credential access is suspected, investigate the identity separately and apply the required account response actions.
Scans and vulnerabilities
A scan may remove malware without fixing the vulnerability or configuration weakness that allowed compromise.
Apply required patches, remove unsafe software and verify the endpoint's security configuration before returning it to normal operation.
Common mistakes
| Mistake | Why it creates risk | Better practice |
|---|---|---|
| Running a full scan immediately on a critical server | Resource consumption can affect production workloads. | Assess operational impact and coordinate with the service owner. |
| Assuming no threats found means no compromise | Behavioural, identity or persistence evidence may remain outside scan detections. | Validate with timeline review, hunting and identity investigation. |
| Restoring a quarantined file too quickly | A malicious item may be returned to the device. | Confirm a false positive and obtain approval before restoration. |
| Releasing isolation after one successful scan | The initial access path or persistence may still exist. | Use defined remediation and recovery criteria before release. |
Key takeaways
- Quick scans provide faster inspection of common threat locations.
- Full scans provide broader coverage but can create greater operational impact.
- Track every remote scan through the Action center.
- Review the actual detection and remediation outcome.
- A completed scan or quarantined file does not prove the incident is resolved.
- Continue hunting, persistence analysis, identity response and recovery validation.
Related Agent Foskett resources
Continue learning
Microsoft Defender for Endpoint Antivirus Scan and Remediation Actions
Microsoft Defender for Endpoint allows authorised analysts to remotely initiate quick and full Microsoft Defender Antivirus scans, monitor them in the Action center and review resulting threat remediation.
Module 3 Endpoint Investigations — Antivirus Scan and Remediation Actions Lesson 18
This Agent Foskett Defender for Endpoint Academy lesson explains scan selection, operational impact, quarantine, response-action monitoring and post-remediation validation.
