Check Microsoft Defender protection status with Get-MpComputerStatus
One PowerShell cmdlet shows whether real-time protection is on, how old the virus signatures are, and when scans last ran.
01Command
$ Get-MpComputerStatus02What it does
The output contains dozens of fields, so target the ones that matter: RealTimeProtectionEnabled, AntivirusEnabled, AntivirusSignatureLastUpdated (stale here means your definitions aren't updating), and QuickScanStartTime. Pick specific properties with `Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusSignatureLastUpdated` for a compact health check. Pairs naturally with Start-MpScan to trigger a scan and Get-MpThreatDetection to review what was found.
03Risk
04Undo
✓No undo needed — this command does not change persistent state.
05Sources
- Get-MpComputerStatus | Microsoft LearnEvidence: Microsoft documents Get-MpComputerStatus returning properties such as RealTimeProtectionEnabled, AntivirusSignatureLastUpdated, and QuickScanStartTime.
Last verified: 2026-09-17 · Category: Security & Privacy
06Related solutions
Read the Authenticode signature status and signer of any executable or script in PowerShell.
Understand PowerShell's execution policy scopes and set the one that lets you run your own local scripts without gutting the security model.
Search inside text files and logs with regex, returning file, line number and match.