$Properties = | Format-List -Property $Properties PowerShell script which checks for EventID 3002 (Real-time protection encountered an error and failed): When carrying out an antimalware platform reset – which rolls the update back to the Inbox CAMP version (.6) – the Network Inspection System (NIS) starts working correctly again and no events are logged. In some instances Defender may need you to take some actions such as quarantining or removing the dangerous file or process.The Microsoft Defender antivirus real-time protection feature stops working after the latest antimalware platform update (.8), due to an error.Įach time the machine is restarted, EventID 3002 (Real-time protection encountered an error and failed) is stored in the event logs and the Network Inspection System (NIS) shows as not enabled, when it should be enabled. If Defender finds malware on your device it'll block it, notify you, and try to remove the malware if it can. For more information see How to start a scan for malware in Microsoft Defender What if Defender finds malware? If you're concerned and want to have Microsoft Defender run a scan right now, you can do that by going to the Device protection page from the Microsoft Defender dashboard. If it spots something it will attempt to block it, and alert you so that you can take action if necessary. Microsoft Defender will also run quick scans of your device on a daily basis, in case anything manages to elude the real-time protection.

Microsoft Defender's real-time anti-malware protection runs whenever your device is on, keeping an eye out for malicious activity. When you first set-up Microsoft Defender on your device we'll run an initial scan to make sure you're starting off clean. Note: Microsoft Defender currently offers anti-malware only on Windows, Mac, and Android.

Event 2001 microsoft antimalware