@@ -5,10 +5,10 @@ ms.service: defender-endpoint ms.localizationpriority: medium author: chrisda ms.author: chrisda-ms.custom: nextgen, msecd-doc-authoring-1016+ms.custom: nextgen, msecd-doc-authoring-1015 ms.reviewer: pahuijbr ms.subservice: ngp-ms.date: 07/02/2026+ms.date: 08/12/2026 appliesto: - Microsoft Defender for Endpoint Plan 1 - Microsoft Defender for Endpoint Plan 2@@ -18,6 +18,7 @@ ms.collection: - mde-ngp ms.topic: how-to ai-usage: ai-assisted+#customer intent: As a security administrator, I want to configure Microsoft Defender Antivirus scanning options so that required file types and locations are scanned. ---  # Configure Microsoft Defender Antivirus scanning options@@ -33,7 +34,6 @@ In Microsoft Intune, use device restriction profiles to set up scanning options. - [Configure device restriction settings in Microsoft Intune](/intune/intune-service/configuration/device-restrictions-configure) - [Microsoft Defender Antivirus device restriction settings for Windows 10 in Intune](/intune/intune-service/configuration/device-restrictions-windows-10#microsoft-defender-antivirus) - ## Prerequisites  ### Supported operating systems@@ -50,20 +50,34 @@ For details on configuring Microsoft Configuration Manager (current branch), see  > [!TIP] > Download the Group Policy Reference Spreadsheet. It lists policy settings for computer and user setups in the Administrative template files for Windows. Use it when you edit Group Policy Objects. Here are the most recent versions:-> - [Group Policy Settings Reference Spreadsheet for Windows 10 May 2020 Update (2004)](https://www.microsoft.com/download/details.aspx?id=101451)-> - [Group Policy Settings Reference Spreadsheet for Windows 11 October 2021 Update (21H2)](https://www.microsoft.com/download/details.aspx?id=103506)+>+> - [Group Policy Settings Reference Spreadsheet for Windows 10 2022 Update (22H2)](https://www.microsoft.com/download/details.aspx?id=104678)+> - [Group Policy Settings Reference Spreadsheet for Windows 11 2025 Update (25H2)](https://www.microsoft.com/download/details.aspx?id=108395)++1. In Centralized Group Policy, open the [Group Policy Management Console (GPMC)](/windows-server/identity/ad-ds/manage/group-policy/group-policy-management-console) on your Group Policy management computer.++1. In the GPMC console tree, expand Group Policy Objects in the forest and domain containing the GPO you want to edit.++1. Right-click the GPO, and then select **Edit**. -1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)).+1. In the **Group Policy Management Editor**, go to **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus**. -1. Right-click the Group Policy Object you want to configure, and then select **Edit**.+   > [!NOTE]+   > Group Policy paths before Windows 10, version 2004 (May 2020) might use _Windows_ Defender Antivirus instead of _Microsoft_ Defender Antivirus. Both names refer to the same policy location. -1. In the **Group Policy Management Editor** go to **Computer configuration** and select **Administrative templates**.+1. In the details pane of **Microsoft Defender Antivirus**, select a location from the [Settings and locations](#settings-and-locations) section. -1. Expand the tree to **Windows components** \> **Microsoft Defender Antivirus**, and then select a location (refer to the [Settings and locations](#settings-and-locations) section).+1. In the details pane of the selected location, open the setting you want to configure. To open and configure a setting, use any of the following methods:+   - Double-click the setting.+   - Right-click the setting, and then select **Edit**.+   - Select the setting, and then select **Action** \> **Edit**. -1. Edit the policy object.+1. In the setting window that opens, configure the setting, and then select **OK**. -1. Select **OK**, and repeat for any other settings.+   Repeat this step as many times as necessary.++> [!TIP]+> You can also configure Group Policy locally on individual devices by using the Local Group Policy Editor (`gpedit.msc`). Navigate to the same path: **Computer configuration** \> **Administrative templates** \> **Windows components** \> **Microsoft Defender Antivirus**.  ### Settings and locations @@ -71,21 +85,21 @@ The following table lists the available scanning policy settings, their Group Po  |Policy item and location|Default setting <br/>(if not configured)|PowerShell `Set-MpPreference` parameter <br/>or WMI property for `MSFT_MpPreference` class| |---|---|---|-|Email scanning <br/> **Scan** > **Turn on e-mail scanning**<br/>See [Email scanning limitations](#email-scanning-limitations) (in this article)|Disabled|`-DisableEmailScanning`|+|Email scanning <br/> **Scan** \> **Turn on e-mail scanning**<br/>See [Email scanning limitations](#email-scanning-limitations) (in this article)|Disabled|`-DisableEmailScanning`| | Script scanning | Enabled  | This policy setting allows you to configure script scanning. If you enable or don't configure this setting, script scanning is enabled. <br/><br/>See [Defender/AllowScriptScanning](/windows/client-management/mdm/policy-csp-defender)  |-|Scan [reparse points](/windows/win32/fileio/reparse-points) <br/> **Scan** > **Turn on reparse point scanning**|Disabled|Not available <br/>See [Reparse points](/windows/win32/fileio/reparse-points)|-|Scan mapped network drives<br/>**Scan** > **Run full scan on mapped network drives**|Disabled|`-DisableScanningMappedNetworkDrivesForFullScan`|-|Scan archive files (such as .zip or .rar files). <br/>**Scan** > **Scan archive files**|Enabled|`-DisableArchiveScanning` <br/><br/>The [extensions exclusion list](microsoft-defender-antivirus-exclusions-overview.md) takes precedence over this setting.|-|Scan files on the network <br/>**Scan** > **Scan network files**|Disabled|`-DisableScanningNetworkFiles`|-|Scan packed executables<br/>**Scan** > **Scan packed executables**|Enabled|Not available <br/><br/>Scan packed executables were removed from the following templates:<br/>- Administrative Templates (.admx) for Windows 11 2023 Update (23H2)<br/>- Administrative Templates (.admx) for Windows 11 2022 Update (22H2) - v3.0 <br/>- Administrative Templates (.admx) for Windows 11 2022 Update (22H2)<br/>- Administrative Templates (.admx) for Windows 11 October 2021 Update (21H2)|-|Scan removable drives during full scans only<br/>**Scan** > **Scan removable drives**|Disabled|`-DisableRemovableDriveScanning`|-|Specify the level of subfolders within an archive folder to scan <p>**Scan** > **Specify the maximum depth to scan archive files**|0|Not available|-|Specify the maximum CPU load (as a percentage) during a scan. <p> **Scan** > **Specify the maximum percentage of CPU utilization during a scan**|50|`-ScanAvgCPULoadFactor`<br/><br/> The maximum CPU load isn't a hard limit, but is guidance for the scanning engine to not exceed the maximum on average. Manual scans ignore this setting and run without any CPU limits.|-|Specify the maximum size (in kilobytes) of archive files that should be scanned.<br/>**Scan** > **Specify the maximum size of archive files to be scanned**|No limit|Not available <br/><br/>The default value of 0 applies no limit|-|Configure low CPU priority for scheduled scans<br/>**Scan** > **Configure low CPU priority for scheduled scans**|Disabled|Not available|-|Configure scanning of network files <br/>**Scan** > **Configure scanning of network files**|Disabled|-DisableScanningNetworkFiles|-|CPU throttling type <br/>**Scan** > **CPU throttling type**|Disabled|-ThrottleForScheduledScanOnly |-|Scan excluded files and directories during quick scan <br/>**Scan** > **Scan excluded files and directories during quick scan**|Disabled|Not available|+|Scan [reparse points](/windows/win32/fileio/reparse-points) <br/> **Scan** \> **Turn on reparse point scanning**|Disabled|Not available <br/>See [Reparse points](/windows/win32/fileio/reparse-points)|+|Scan mapped network drives<br/>**Scan** \> **Run full scan on mapped network drives**|Disabled|`-DisableScanningMappedNetworkDrivesForFullScan`|+|Scan archive files (such as .zip or .rar files). <br/>**Scan** \> **Scan archive files**|Enabled|`-DisableArchiveScanning` <br/><br/>The [extensions exclusion list](microsoft-defender-antivirus-exclusions-overview.md) takes precedence over this setting.|+|Scan files on the network <br/>**Scan** \> **Scan network files**|Disabled|`-DisableScanningNetworkFiles`|+|Scan packed executables<br/>**Scan** \> **Scan packed executables**|Enabled|Not available <br/><br/>Scan packed executables were removed from the following templates:<br/>- Administrative Templates (.admx) for Windows 11 2023 Update (23H2)<br/>- Administrative Templates (.admx) for Windows 11 2022 Update (22H2) - v3.0 <br/>- Administrative Templates (.admx) for Windows 11 2022 Update (22H2)<br/>- Administrative Templates (.admx) for Windows 11 October 2021 Update (21H2)|+|Scan removable drives during full scans only<br/>**Scan** \> **Scan removable drives**|Disabled|`-DisableRemovableDriveScanning`|+|Specify the level of subfolders within an archive folder to scan <p> **Scan** \> **Specify the maximum depth to scan archive files**|0|Not available|+|Specify the maximum CPU load (as a percentage) during a scan. <p> **Scan** \> **Specify the maximum percentage of CPU utilization during a scan**|50|`-ScanAvgCPULoadFactor`<br/><br/> The maximum CPU load isn't a hard limit, but is guidance for the scanning engine to not exceed the maximum on average. Manual scans ignore this setting and run without any CPU limits.|+|Specify the maximum size (in kilobytes) of archive files that should be scanned.<br/>**Scan** \> **Specify the maximum size of archive files to be scanned**|No limit|Not available <br/><br/>The default value of 0 applies no limit|+|Configure low CPU priority for scheduled scans<br/>**Scan** \> **Configure low CPU priority for scheduled scans**|Disabled|Not available|+|Configure scanning of network files <br/>**Scan** \> **Configure scanning of network files**|Disabled|-DisableScanningNetworkFiles|+|CPU throttling type <br/>**Scan** \> **CPU throttling type**|Disabled|-ThrottleForScheduledScanOnly |+|Scan excluded files and directories during quick scan <br/>**Scan** \> **Scan excluded files and directories during quick scan**|Disabled|Not available|  > [!NOTE] > If real-time protection is turned on, files are scanned before they're accessed and executed. The scanning scope includes all files, such as files on mounted removable media, like USB drives. If the device performing the scan has real-time protection or on-access protection turned on, the scan also includes network shares.@@ -122,5 +136,3 @@ If Microsoft Defender Antivirus detects a threat inside an email message, the fo ## Scanning mapped network drives  On all supported operating systems, only the network drives that are mapped at system level are scanned. User-level mapped network drives aren't scanned. User-level mapped network drives are those that a user maps in their session manually and using their own credentials.--