Windows 7 Defender not scanning on schedule (issue with Task Scheduler - MP Schedule Scan?)
I am running Windows 7 Ult. RTM Technet release.The system I am using has a clean default install of Windows 7 (using a system image). No other software installed.Windows Defender:Client Version: 6.1.7600.16385Engine Version: 1.1.4903.0Antispyware definitions: 1.63.1207.0The issue I am having is that Windows Defender is notscanning as scheduled. By Default, Windows 7 Defender is scheduled to scan at 2am with the option "run scan only when system is idle". I changed this to scan at 8am. The next day, Defender ran as scheduled. I then decided to disable the option "run scan only when system is idle". The next day I noticed Defender did not scan at 8am.The Windows defender service was still running and I could manually initiate a scan. No errors in Event Viewer.I then checked Task Scheduler and I noticed there was no entry for Windows Defender - MP Scheduled Scan.So I reloaded my system to default using my backup Windows 7image.I went to Task Scheduler and MP Scheduled Scan was there (set for 2am).I used the Defender UI to set the scan time to 8am. That change was reflected in MP Scheduled Scan (now set for 8am).However, when I used the Defender UI to disable "run scan only when system is idle", MP Scheduled Scan was deleted!I now know why the scan did not occur.Can anyone please provide some more insight into the relationship between Windows Defender and MP Scheduled Scan. Why does disabling "run scan only when system is idle" delete the MP Scheduled Scan in Task Scheduler? Is this by design?Thank you for any help.
August 11th, 2009 10:25pm

Do you have third party anti-virus or anti-spyware? If so, I suggest that you check the records of them to verify if they have done any tasks in Registry to delete the following keys. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows DefenderHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{724D1A93-A15F-4AD8-9EC9-798B94885DC5} If there is not records can be check, I suggest that you temporary remove the security programs, and then check if the issue still occurs. Additionally, we do not need to restore the system to get to schedule back. Just re-configure the setting in Windows Defender, and restart then you will see the task is back. This issue also occurs if you configure to use any third party Registry Cleaners. However, if the issue occurs when any security programs are removed, I suggest that you run In-place Upgrade to repair the system for Windows Defender. Arthur Xie - MSFT
Free Windows Admin Tool Kit Click here and download it now
August 13th, 2009 11:37am

Hello and thank you for your reply.We areusing Windows 7 Ultimate 64-bit Technet RTM ISO. We install the OSthen immediately image the drive. We then use this image to restore our system after evaluating various testscenarios. Performing an in-place upgrade is not an option unfortunately.No third party software is installed (no anti-virus, spyware, registry cleaners)With regards to the registry keys:- Both keys are present when I restore thesystem from the image.- Disabling "run scan only when system is idle" using the Defender UIwill delete both keys and will also delete the trigger/task in Task Scheduler.Can you confirm that on your system, disabling that option in the Defender UI does NOT delete the registry keys and the trigger/task?Thank you for your help.
August 13th, 2009 5:39pm

Hi, I forgot to tell you that during my testing it did not occur. So it should not be a design issue. Since the issue is not caused by third party programs either, I suggested that you repair the system to resolve it. Now it seems that you may need a new system installation image to repair the system, or reinstall it.`Arthur Xie - MSFT
Free Windows Admin Tool Kit Click here and download it now
August 17th, 2009 10:21am

I have the same issue with my six-month-old laptop. No third party anti-virus or anti spyware, and I'm seeing exactly the same behavior. Here's the sequence: -- Check the "Start scheduled scan only when my computer is on but not in use" in the MSE dialog, then click "Save changes". MP Security Essentials then appears in the Task Scheduler. -- Open the MP Security Essentials Properties dialog in Task Scheduler, and make changes to it. -- Return to the MSE dialog, uncheck "Start scheduled scan..." and save -- Return to the MP Security Essentials Properties dialog and attempt to save the changes, at which point I am informed that the task has been deleted. I'd really prefer some solution short of reinstalling, if there is one.
November 9th, 2011 2:27pm

Yeah a system re-install to "repair" a bug in Windows defender is just going to be a waste of time so hopefully you didn't do that. What this appears to boil down to is that if you un-check the option to only run when the system is idle (many people will schedule for a time they know they won't be at the computer and thus do not want any ambiguity about whether the task will run or not) Windows Defender will not scan at all because it fails to create a scheduled task. (I tested this with and without A/V software enabled, but I would be very surprised if A/V software would have any affect on direct calls to the Task Scheduler API - I have experience with this API since I use it in software I have worked on called WinReminders). Rather than go into the full details see here: http://answers.microsoft.com/en-us/windows/forum/windows_7-security/scheduled-scan-for-windows-defender-does-not-work/7b5afec9-a92f-46d7-a719-652dcc87ff2a?msgId=001b3751-f885-4860-aefe-042a60b00fc3 I have confirmed this problem on multiple Windows 7 machines (I have access to 4 physical machines here, plus many virtual machines also) and the best comment I can come up about the schedule task creation in Windows Defender (even when that idle setting is checked) is that it is "flaky". (I'm not sure about all development shops, but its a term we use when something isn't working right and the behavior doesn't always seem to be 100% consistent). Even when you can get Windows Defender to create the schedule task, some of the settings it creates are head scratchers. For example say you chose 10:00am as the time; the scheduled task may be for 10:00:23am. I guess the seconds are not explicitly set. OK, in practice this doesn't make much difference but when you are already skeptical, waiting for a scan to kick off at 10:00:00am and it waits another 23 seconds, that can add further doubt to your mind! (I guess this is why in the user interface it says "around" this time; it seems a UI cover up for the problem in setting the scheduled task time). Additionally, and this is benign, but interesting anyway, is that the task is set to expire in 2100! That just seems like a redundant setting IMO. What Windows 7 machine in 2012 will still be running in 2100 and even if there was, why would we want to stop Windows Defender running on that date? :-) Maybe it was too hard to make the task never expire for whoever wrote that code. Task Scheduler itself seems to be extremely robust (very impressive really), so I think this is just a problem with Windows Defender's interaction with that API. If you know what to check for you can fix or work around the problems, plus power users have the option of just creating custom tasks and avoiding the Windows Defender UI altogether. Hope this helps someone out there who can't figure out why their Windows Defender scans do not run as scheduled. Cheers. Wayne H
Free Windows Admin Tool Kit Click here and download it now
April 21st, 2012 1:00am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics