Scan a single file with Microsoft Defender from the command line

Use the Defender command-line tool MpCmdRun.exe to check one downloaded file for malware without a full system scan.

WindowscmdantivirusdefenderLow risk

Run: "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\path\to\file.exe"

01Command

Command

$ "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\me\Downloads\file.exe"

02What it does

MpCmdRun.exe ships with Windows Defender and can scan on demand. -ScanType 3 means a custom scan, and -File restricts it to the single file or folder you name. Results appear in the console, and any detections also show up in Windows Security's protection history.

03Risk

RiskLow risk

!Warning: A clean result isn't a guarantee — new malware can evade local signatures, so also upload unknown files to VirusTotal.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

Use the command line to manage Microsoft Defender Antivirus
Microsoft Learn · vendor-doc · 2026-09-17
Evidence: Official MpCmdRun.exe reference: the -Scan tool with -ScanType 3 performs a custom scan, and -File <path> limits the scan to a specific file or folder.
Test-PathUsingWindowsDefender.ps1 (GenXdev.Windows)
PowerShell Gallery · community · 2026-09-17
Evidence: Community PowerShell function that invokes MpCmdRun.exe with -Scan -ScanType 3 -File to scan a single path with Windows Defender from the command line.

Last verified: 2026-09-19 · Category: Security & Privacy