On-demand scan command line interface

With the on-demand scan command line interface, you can start, stop, pause, resume, and get status for quick, full, and custom on-demand scans from the command line or as part of a batch file. All users can start a scan and check the status of a scan, regardless of the interface mode for the Endpoint Security Client.

Prerequisites

  • The Threat Prevention service (mfetp.exe) must already be running for amcfg.exe to run.
  • The interface mode for the Endpoint Security Client must be set to Full access if a user wants to stop, pause or resume an on-demand scan through command line.

Syntax: On-demand scan command line interface

The on-demand scan syntax for amcfg.exe is:

installation_path\amcfg.exe /scan /task [ command_args ]

  • installation_path — C:\Program Files (x86)\McAfee\Endpoint Security\Threat Prevention by default
  • command_args — One of the commands in the On‑demand scan command arguments table

Arguments can appear in any order, except that you must keep each argument with its value.

The scan is executed only if all values are correct. Otherwise, amcfg.exe displays a message with the possible values and doesn't run the scan. If the command line includes multiple values for an argument, the scan runs using only the first value. The scanner ignores any invalid configuration arguments.

On-demand scan command arguments
Argument Value Description
/task
  • quick — Runs the default Quick Scan.
  • full — Runs the default Full Scan.
  • custom_scan_ID — Runs a custom scan with the specified ID.

    To get a list of scan IDs for the custom scans that are currently defined, run amcfg.exe /scan /list.

Specifies the type of scan task to run.

If you enter amcfg.exe /scan (without specifying /task), a Quick Scan starts by default.

/action
  • cancel — Stops the currently running scan, if applicable.
  • pause — Pauses the currently running scan, if applicable.
    Note: When a scan is paused, if you run /action start for the same scan, the scan starts again from the beginning. Use resume to continue a paused scan.
  • resume — Continues a paused scan, if applicable.
  • start — Starts the scan.
  • status — Displays the status of the last scan of the specified type. Check the log file for information about any detections.
Specifies the scan action to apply to the previously specified /task.
Note: The /task argument is required with the /action argument.

All users can start a scan and check the status of a scan, regardless of the interface mode for the Endpoint Security Client.

Note: Avoid using other arguments while executing /action status for the custom scan.

Examples: On-demand scan command line interface

Open a command prompt and change to the installation location of amcfg.exe to run these example commands. By default, amcfg.exe is located in the C:\Program Files (x86)\McAfee\Endpoint Security\Threat Prevention folder.

To... Run this command
Start a Quick Scan. amcfg.exe /scan
amcfg.exe /scan /task quick /action start
Display the status of a Quick Scan. amcfg.exe /scan /task quick /action status
Pause the currently running Quick Scan. amcfg.exe /scan /task quick /action pause
Resume the currently paused Quick Scan. amcfg.exe /scan /task quick /action resume
Stop a Quick Scan. amcfg.exe /scan /task quick /action cancel
Start a Full Scan. amcfg.exe /scan /task full /action start
Display the status of a Full Scan. amcfg.exe /scan /task full /action status
Pause the currently running Full Scan. amcfg.exe /scan /task full /action pause
Resume the currently paused Full Scan. amcfg.exe /scan /task full /action resume
Stop a Full Scan. amcfg.exe /scan /task full /action cancel
Display a list of defined custom scan names and their scan IDs. amcfg.exe /scan /list
Start a custom scan with the specified ID. amcfg.exe /scan /task scan_ID /action start
Display the status of a custom scan with the specified ID. amcfg.exe /scan /task scan_ID /action status
Pause the currently running custom scan with the specified ID. amcfg.exe /scan /task scan_ID /action pause
Resume the currently paused custom scan with the specified ID. amcfg.exe /scan /task scan_ID /action resume
Stop a custom scan with the specified ID. amcfg.exe /scan /task scan_ID /action cancel