PRODUCT IOTS » Backlog

Environment details
6.0.1

Prerequisites
normally enrolled windows device

Steps
go to windows single device view
go to windows defender tab
initiate full and quick scans

Description
Full and Quick scans are not working.

Possible reasons: https://answers.microsoft.com/en-us/windows/forum/all/unable-to-access-quarantine-or-scans-folder-in/747bbdec-4efa-4df3-a754-387b6646160b

event viewer error: [1] [2]

Result

[1]

[2]
Log Name: Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin
Source: Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider
Date: 27/01/2024 12:05:21
Event ID: 404
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: DESKTOP-SVBB1QR
Description:
MDM ConfigurationManager: Command failure status. Configuration Source ID: (E625E082-51C8-4E95-84B1-B1C026232A4C), Enrollment Name: (MDMFull), Provider Name: (Defender), Command Type: (Execute), CSP URI: (./Vendor/MSFT/Defender/Scan), Result: (The process cannot access the file because it is being used by another process.).
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider" Guid="{3da494e4-0fe2-415c-b895-fb5265c5c83b}" />
<EventID>404</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2024-01-27T12:05:21.8717024Z" />
<EventRecordID>122370</EventRecordID>
<Correlation />
<Execution ProcessID="11164" ThreadID="9248" />
<Channel>Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin</Channel>
<Computer>DESKTOP-SVBB1QR</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="Message1">E625E082-51C8-4E95-84B1-B1C026232A4C</Data>
<Data Name="Message2">MDMFull</Data>
<Data Name="Message3">Defender</Data>
<Data Name="InternalCmdType">6</Data>
<Data Name="Message5">./Vendor/MSFT/Defender/Scan</Data>
<Data Name="HexInt1">0x80070020</Data>
</EventData>
</Event>