Detections
Analytics

WNDF-AV-000026 - Microsoft Defender AV must be configured to perform a weekly scheduled scan.

Information

This policy setting allows specifying the day of the week on which to perform a scheduled scan. The scan can also be configured to run every day or to never run at all. This setting can be configured with the following ordinal number values:
(0x0) Every Day
(0x1) Sunday
(0x2) Monday
(0x3) Tuesday
(0x4) Wednesday
(0x5) Thursday
(0x6) Friday
(0x7) Saturday
(0x8) Never (default)

If this setting is enabled, a scheduled scan will run at the frequency specified. If this setting is disabled or not configured, a scheduled scan will run at a default frequency.

Solution

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Scan >> 'Specify the day of the week to run a scheduled scan' to 'Enabled ' and select anything other than 'Never' in the drop-down box.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Defender_Antivirus_V2R10_STIG.zip

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-3c.1., CAT|II, CCI|CCI-001241, Rule-ID|SV-213450r1260216_rule, STIG-ID|WNDF-AV-000026, STIG-Legacy|SV-89917, STIG-Legacy|V-75237, Vuln-ID|V-213450

Plugin: Windows

Control ID: 718202849dffe5d6976b732e8b7e1b379da7c5efa6356caae7ab5f290d3c2919