Automate Windows Defender Status and Triage with PowerShell
Get a daily, fleet-wide picture of Windows Defender health — status, signatures, exclusions, and recent threats — without logging into a single endpoint.
Microsoft Defender for Endpoint has a great portal, but a lot of teams still need a local-side view of Defender health: are signatures current, is real-time protection on, what threats have been detected, and what exclusions exist.
PowerShell gives you that view. PSForge gives you the workflow.
Why a Defender workflow is worth building
Even in environments with full EDR, Windows Defender is the last line on every endpoint. Knowing its status — without clicking through dozens of devices — is the difference between catching a misconfiguration in a day or in a quarter.
Bad exclusions in particular are a quiet risk: someone added a folder for a vendor, never removed it, and now an attacker has a free zone.
What the workflow should answer
- Is Defender running and up to date on every device in scope?
- Are signature definitions older than they should be?
- What threats have been detected and remediated recently?
- What exclusions exist — and do any of them look unusual?
Example Windows Defender triage workflow
- Run a Defender status check across the device list
- Trigger a signature update where definitions are stale
- Run a quick scan on flagged devices
- Export a threat detection report for the last 30 days
- Review and prune Defender exclusions that should not exist
Final thoughts
Defender is doing more than people give it credit for — but only if you can see what it is doing.
A PSForge workflow turns Defender status into a daily report instead of a quarterly fire drill.