Schedule Microsoft Defender Antivirus Scans with Intune on macOS

Platforms

macOS

Products

IntuneDefender for Endpoint

Result

A daily Quick Scan at 9:00 AM and after reboots, plus a weekly Full Scan on Thursday at 12:30 PM

Overview

Schedule daily Quick Scans and weekly Full Scans with Microsoft Defender for Endpoint on Intune-managed Macs, using launchd jobs that Intune shell scripts install.

Microsoft Defender for Endpoint (MDE) offers different types of antivirus scans that administrators can schedule on Intune-managed Mac devices (users can also start them on demand):

1. Quick Scan looks at all known locations where there could be malware registered to start with the system. It checks processes, memory, profiles and certain locations on the device. A Quick Scan usually takes only a few seconds (less than 10 s).

2. Full Scan starts with a Quick Scan and then continues with a sequential file scan of all mounted fixed disks and removable/network drives. A Full Scan can take from several minutes to an hour or longer to complete.

3. Custom Scan lets users select specific locations, folders or files to scan.

Administrators can schedule Quick Scan and Full Scan jobs by creating Launch Daemons and agents on macOS devices. Launch Daemons (managed by launchd) are simply property list (PLIST) files that this macOS service management framework uses to define jobs.

In short, scheduled scan jobs on macOS are added or removed by creating or deleting PLIST files in the /Library/LaunchDaemons/ directory:

– Quick Scan file: com.microsoft.wdav.schedquickscan.plist

– Full Scan file: com.microsoft.wdav.schedfullscan.plist

Microsoft Intune can install, replace or delete custom PLIST files in the LaunchDaemons directory using bash shell scripts (.sh), as in this Quick Scan job example by Neil Johnson: Script to install LaunchDaemon to schedule a MDATP Quick Scan.

The example script contains optional keys that you customize to your business requirements, for example to run a scan at a specific date and time, or to run additional scans after a reboot.

The StartCalendarInterval key starts the job at the specified calendar interval:

– Minute <integer> – The minute on which the job runs.

– Hour <integer> – The hour on which the job runs.

– Day <integer> – The day on which the job runs.

– Weekday <integer> – The weekday on which the job runs (0 and 7 are Sundays).

– Month <integer> – The month on which the job runs.

The RunAtLoad and KeepAlive keys are optional and useful if you want an antivirus scan (e.g. a Quick Scan) to start after the device reboots.

In this post, I show how to use Microsoft Intune to deploy PLIST files that schedule Quick and Full antivirus scans on Mac devices that are enrolled in Intune and onboarded to Defender for Endpoint.

Prerequisites

Before you start, check that you have the following.

Apple background reading: Creating Launch Daemons and Agents and Information Property List Files.

Configuration

With the prerequisites in place, set it up in this order.

Step	Console	What you set
3.1	Intune	Shell script that installs the daily Quick Scan job
3.2	Intune	Shell script that installs the weekly Full Scan job
3.3	Intune	Shell script that deletes a scan job
3.4	Defender	Advanced Hunting query for completed scans

Install the Quick Scan job

Intune admin center

The goal is to run a daily Quick Scan at 9:00 AM and whenever the Mac device reboots. The RunAtLoad and KeepAlive keys are required for this: they ensure that the Quick Scan starts every time a user signs in after a reboot.

Note: The Quick Scan takes only a few seconds to complete.

My Quick Scan job script:

#!/bin/bash
#set -x

##############################################################################################################
##
## Script to install LaunchDaemon to schedule a Defender for Endpoint QUICK SCAN job
##
## Note1: Edit StartCalendarInterval key to change time/date
## Note2: Edit RunAtLoad and KeepAlive keys to enable/disable scan at next device reboot/resume from sleep
##
## P.S This is a modified version of the example QuickScan job script shared by the Neil Johnson on GitHub:
## https://github.com/microsoft/shell-intune-samples/blob/master/macOS/Config/MDATP/installMDATPQuickScanJob.sh
##
###############################################################################################################

# Define variables
log="/var/log/schedquickscan.log"
plistname="com.microsoft.wdav.schedquickscan"
plistfile="/Library/LaunchDaemons/com.microsoft.wdav.schedquickscan.plist"
exec 1>> $log 2>&1

if test -f "$plistfile"; then
    echo "$(date) - Found existing $plistfile"
    echo "$(date) - Unloading $plistname"
    launchctl unload $plistfile
    echo "$(date) - Removing $plistfile"
    rm -rf $plistfile
fi

echo "$(date) - Installing new $plistfile"
cat > $plistfile <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>RunAtLoad</key>
    <true/>
    <key>KeepAlive</key>
    <dict>
        <key>SuccessfulExit</key>
        <false/>
    </dict>
	<key>Label</key>
	<string>com.microsoft.wdav.schedquickscan</string>
	<key>ProgramArguments</key>
	<array>
		<string>sh</string>
		<string>-c</string>
		<string>/usr/local/bin/mdatp scan quick</string>
	</array>
	<key>StartCalendarInterval</key>
	<dict>
		<key>Hour</key>
		<integer>9</integer>
		<key>Minute</key>
		<integer>0</integer>
	</dict>
	<key>WorkingDirectory</key>
	<string>/usr/local/bin</string>
</dict>
</plist>
EOF

echo "$(date) - Loading $plistfile"
launchctl load $plistfile

echo "$(date) - Starting $plistname"
launchctl start $plistname

exit 0

The keys to customize in this script are StartCalendarInterval, RunAtLoad and KeepAlive:

<key>RunAtLoad</key>
<true/>
<key>KeepAlive</key>
<dict>
    <key>SuccessfulExit</key>
    <false/>
</dict>

<key>StartCalendarInterval</key>
<dict>
    <key>Hour</key>
    <integer>9</integer>
    <key>Minute</key>
    <integer>0</integer>
</dict>

Note: If you don't want the Quick Scan to run every time the device restarts, simply remove the RunAtLoad and KeepAlive keys and their values.

Deploy the script with Intune to managed Mac devices using these settings:

• Run script as signed-in user: No
• Hide script notifications on devices: Yes
• Script frequency: Not configured
• Max number of times to retry if script fails: 3 times

Note: Don't configure script frequency to avoid additional scans started by Intune outside the configured schedule (or outside device restarts, for Quick Scans).

Install the Full Scan job

Intune admin center

The goal is to run a weekly Full Scan on Thursday at 12:30 PM. No additional Full Scans should run during the week, because they may affect the user's work (so no Full Scans after the device restarts).

Note: A Full Scan may run from several minutes to a few hours.

My Full Scan job installation script:

#!/bin/bash
#set -x

###############################################################################################################
##
## Script to install LaunchDaemon to schedule a Defender for Endpoint (MDE) Antivirus FULL SCAN job
##
## Note1: Edit StartCalendarInterval key to change time/date 
## Note2: RunAtLoad and KeepAlive keys are not configured to avoid additional Full scans running at device reboot
##
## P.S This is a modified version of the example QuickScan job script shared by the Neil Johnson on GitHub:
## https://github.com/microsoft/shell-intune-samples/blob/master/macOS/Config/MDATP/installMDATPQuickScanJob.sh
##
###############################################################################################################

# Define variables
log="/var/log/schedfullscan.log"
plistname="com.microsoft.wdav.schedfullscan"
plistfile="/Library/LaunchDaemons/com.microsoft.wdav.schedfullscan.plist"
exec 1>> $log 2>&1

if test -f "$plistfile"; then
    echo "$(date) - Found existing $plistfile"
    echo "$(date) - Unloading $plistname"
    launchctl unload $plistfile
    echo "$(date) - Removing $plistfile"
    rm -rf $plistfile
fi

echo "$(date) - Installing new $plistfile"
cat > $plistfile <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.microsoft.wdav.schedfullscan</string>
    <key>ProgramArguments</key>
    <array>
        <string>sh</string>
        <string>-c</string>
        <string>/usr/local/bin/mdatp scan full</string>
    </array>
	<key>RootDirectory</key>
	<string>/usr/local/bin</string>
    <key>StartCalendarInterval</key>
    <dict>
        <key>Weekday</key>
        <integer>4</integer>
        <key>Hour</key>
        <integer>12</integer>
        <key>Minute</key>
        <integer>30</integer>
    </dict>
	<key>WorkingDirectory</key>
	<string>/usr/local/bin</string>
</dict>
</plist>
EOF

echo "$(date) - Loading $plistfile"
launchctl load $plistfile

echo "$(date) - Starting $plistname"
launchctl start $plistname

exit 0

To customize the schedule, modify the StartCalendarInterval key:

<key>StartCalendarInterval</key>
<dict>
    <key>Weekday</key>
    <integer>4</integer>
    <key>Hour</key>
    <integer>12</integer>
    <key>Minute</key>
    <integer>30</integer>
</dict>

Note: The RunAtLoad and KeepAlive keys are NOT configured, to avoid additional Full Scans after the device restarts.

Deploy the Intune script to macOS devices using these settings:

• Run script as signed-in user: No
• Hide script notifications on devices: Yes
• Script frequency: Not configured
• Max number of times to retry if script fails: 3 times

Note: Don't configure script frequency to avoid additional scans started by Intune outside the configured schedule.

Delete a scheduled scan job

Intune admin center

To remove a scheduled job, simply delete the PLIST file that the install script created earlier, again using Intune. This example script deletes the Full Scan PLIST file com.microsoft.wdav.schedfullscan.plist:

#!/bin/bash
#set -x
chmod 777 /Library/LaunchDaemons/com.microsoft.wdav.schedfullscan.plist
rm /Library/LaunchDaemons/com.microsoft.wdav.schedfullscan.plist

Verify scans with Advanced Hunting

Microsoft Defender portal

The Advanced Hunting feature of Defender for Endpoint is based on the Kusto Query Language (KQL) and you can use it to check completed antivirus scans, with timestamps, on your devices:

KQL Query for Antivirus Completed Scans on macOS:

DeviceEvents
| join kind=inner DeviceInfo on DeviceId
| where OSPlatform has "macOS"
| where AdditionalFields has "quick"
| where ActionType == "AntivirusScanCompleted"
| summarize arg_max(Timestamp,*) by DeviceName
| project Timestamp, DeviceName, LoggedOnUsers, ActionType, AdditionalFields
| order by Timestamp

Note: To get Full Scan results, change the AdditionalFields value from "quick" to "full"

Result

As scheduled, the daily Quick Scan runs at 9:00 AM. Additional Quick Scans run after the device reboots or when antivirus signatures are updated.

The Full Scan runs once a week on Thursdays at 12:30 PM, and no additional Full Scans run (unless the user starts one manually).

In the /Library/LaunchDaemons directory, the user can see the two PLIST files created by Intune:

The log files schedquickscan.log and schedfullscan.log are in the /var/log/ directory on the Mac: