It certainly is true that real-time protection mitigates the need for scheduling Full Scans – but the new Windows Defender actually uses a much more powerful “on-access” real-time protection – a kernel-mode mini-filter driver
(WdFilter.sys) that continuously scans file-system activity. On the other hand, it’s entirely possible for hidden malware to fly in under this on-access radar, because this form of real-time protection has to be very quick in order to keep it from bogging
down the system – and consequently it never takes the time to scan the contents of archived files. So a Full Scan is still very useful because it does unpack those container files in search of any hidden (but inactive) malware that might have gotten through
your primary line of defense.
What we need to look at here is the rationale for adding a scheduled scan by modifying the Windows Defender Scheduled Scan task. First,
ask yourself this question: If Automatic Maintenance already runs a Quick Scan on a daily basis, then what possible reason would there be for adding a second scheduled Quick Scan? The Microsoft method just adds a totally redundant scan,
which doesn’t really make any sense, but otherwise is completely harmless.
It should be clear that the only additional scheduled scan that would make any sense would be a scheduled Full Scan. Unfortunately, if you schedule a Full Scan by changing the command line (action) of the Windows Defender Scheduled Scan task, as the
Windows Club tutorial recommends, the result might not be quite what you expected, and it also might not be quite so harmless. The Windows Club tutorial, like many of the other Windows-help site tutorials, was copied from the Eight Forums tutorial (recommended
above by PA Bear MS MVP); and the
Eight Forumsmethod was based on the mistaken notion that the Windows Defender Scheduled Scan task was NOT being triggered by Automatic Maintenance:
http://www.eightforums.com/tutorials/14264-windows-defender-scheduled-scan-set-up-windows-8-a-2.html
But of course it IS being triggered by Automatic Maintenance; so if you schedule a weekly Full Scan with this method; for example, the unintended consequence is that the daily Automatic Maintenance scan is also converted into
a Full Scan (you can easily confirm this in Event Viewer).
Not only does that not make any sense; it also makes it quite likely that you’re going to create some kind of bottleneck in the Automatic Maintenance workflow, since the default mode for this service runs maintenance tasks strictly during system idle
states and within strictly limited “maintenance windows”. So if you decide to cut corners here and go with this “simple” method of creating a scheduled Full Scan, you should definitely pay close attention to the results that get logged in Event Viewer and
Task Scheduler. Also, the new Windows Defender icon might be useful for monitoring your scans –
if you load it at startup:
http://answers.microsoft.com/en-us/protect/forum/protect\_defender-protect\_start/is-windows-defender-icon-supposed-to-be-in-system/6cfa9d1d-3db8-49a9-add7-280a284ccfdc
Anyone wishing to add a proper scheduled Full Scan can refer to these resourses:
https://www.winhelp.us/kaseke/configure-windows-defender-in-windows-8.html#.Ub3sFMXn_IU
http://answers.microsoft.com/en-us/protect/forum/mse-protect\_start/running-mse-full-scan-as-a-scheduled-task/f627f5ce-0b74-4b1d-be64-d6ceeb4d9b02
http://answers.microsoft.com/en-us/windows/forum/windows\_8-performance/windows-defender-windows-8-schedule-option-missing/b6603c6a-cba9-4ba7-a894-37f895fc6c92?page=1
GreginMich