Free tools Windows power users keep installed
One-click scans. No signup required.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Yes. Microsoft Defender for Endpoint on macOS supports hourly, daily, and weekly scheduled scans. However, Intune does not expose these macOS schedules as ordinary fields in its standard Antivirus policy. The supported approach is to deploy a custom Apple .mobileconfig profile containing Defender’s com.microsoft.wdav preference domain.
This requires Defender for Endpoint Plan 1 or Plan 2 and Defender Platform Update 101.23122.0005 or later. The Windows scheduled-scan workflow should not be applied to Macs.
What you can schedule
Defender for Endpoint on macOS supports three recurring scan options:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Hourly quick scans: configured with an interval from one to 24 hours.
- Daily quick scans: configured for a local device time.
- Weekly scans: configured as either a quick scan or a full scan on a selected day and time.
These options can be used together. For example, an organization could run daily quick scans and a weekly full scan. Scheduled scans supplement—not replace—real-time protection, cloud-delivered protection, automatic security-intelligence updates, Defender onboarding, and appropriate macOS permissions.
#1 Best Overall
- AN AMAZING MAC AT A SURPRISING PRICE — With an incredibly portable and durable aluminum design, up to 16 hours of battery life,* and the A18 Pro chip, MacBook Neo is ready to go wherever school takes you.
- FOUR STUNNING COLORS. ONE DURABLE DESIGN — Choose from four beautiful colors — Silver, Blush, Citrus, or Indigo — each with a color-coordinated keyboard. And MacBook Neo is made with a durable recycled aluminum enclosure that helps it reach 60 percent recycled content by weight — the most ever in any Apple product.*
- FLY THROUGH EVERYDAY ASSIGNMENTS — Whether you’re cramming for finals, using Apple Intelligence* to summarize class notes, creating presentations, or even playing the latest Apple Arcade game,* MacBook Neo delivers the performance and AI capabilities you need to get things done.
- UP TO 16 HOURS OF BATTERY LIFE — MacBook Neo delivers all day battery life, so you can power through from early morning classes to late night study sessions without worrying about plugging in.
- A VIBRANT 13-INCH DISPLAY* — The gorgeous Liquid Retina display on MacBook Neo supports 1 billion colors, so photos and videos pop and text is crisp for easy reading.
Microsoft documents the feature in its macOS scheduled-scan guidance.
Prerequisites
- Microsoft Defender for Endpoint Plan 1 or Plan 2.
- Defender Platform Update 101.23122.0005 or newer.
- A Mac enrolled in Intune and able to receive configuration profiles.
- Microsoft Defender for Endpoint installed and onboarded.
- The Defender-related macOS configuration profiles and permissions required by your deployment already applied.
- A small test device group before production assignment.
Defender and Intune licensing are separate considerations. Intune may already be included with Microsoft 365 E3, E5, EMS, or Business Premium, depending on your agreement, but Intune licensing alone does not automatically provide Defender for Endpoint entitlement. Check your existing Microsoft licensing before buying standalone subscriptions.
Choose a practical scan strategy
| Scenario | Suggested configuration | Trade-off |
|---|---|---|
| Typical employee Macs | Daily quick scan | Regular coverage with relatively low disruption. |
| Light-touch deployment | Weekly quick scan | Lower resource use, but less frequent scheduled coverage. |
| Higher-risk or maintenance devices | Weekly full scan | More comprehensive scanning, with greater CPU, storage, battery, and time impact. |
| Large fleet | Randomized daily or weekly start times | Reduces simultaneous load but makes timing less predictable. |
| User-facing laptops | Enable low-priority scheduled scans | Reduces user impact but may lengthen scan completion. |
A full scan is not automatically better for every Mac. Daily quick scans are generally more appropriate for routine coverage, while weekly full scans may be reserved for selected groups or maintenance windows.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Understand the schedule values
Time of day
timeOfDay is the number of minutes after midnight, using the Mac’s local time zone.
| Local time | Value |
|---|---|
| 2:00 AM | 120 |
| 12:00 PM | 720 |
| 2:40 PM | 880 |
| 2:45 PM | 885 |
| 5:00 PM | 1020 |
The same value does not represent one universal UTC time. Macs in different time zones run the scan according to their own local clocks.
Weekly day values
| Value | Meaning |
|---|---|
0 |
Every day |
1 |
Sunday |
2 |
Monday |
3 |
Tuesday |
4 |
Wednesday |
5 |
Thursday |
6 |
Friday |
7 |
Saturday |
8 |
Never |
Hourly intervals
For scheduled quick scans, interval accepts 0 for never or 1 through 24 for a scan every one to 24 hours. The documented value "1" represents an hourly quick scan.
Randomized start times
randomizeScanStartTime can randomize daily or weekly scan starts by up to a specified number of hours. A 2 PM scan with a value of 2 may begin between 2 PM and 4 PM. This is useful when many Macs share the same assignment and you want to avoid a simultaneous CPU, disk, or network load.
Rank #2
- BUILT FOR COLLEGE. AND BEYOND — MacBook Air with the M5 chip packs blazing speed and powerful AI capabilities into an incredibly portable design. And with up to 18 hours of battery life,* this thin and light powerhouse is ready to take on almost any major, just about anywhere.
- TEAR THROUGH TOUGH ASSIGNMENTS — With its faster CPU and unified memory, the M5 chip delivers even more performance and fluidity across apps, making multitasking and creative workflows smooth and responsive. A powerful Neural Engine and next-generation GPU with Neural Accelerators give you a powerful platform for AI.
- MAKE QUICK WORK OF YOUR TO-DO LIST — Apple Intelligence helps you write, express yourself, and get things done effortlessly — whether it’s for school or everyday life. With groundbreaking privacy protections, it gives you peace of mind that no one else can access your data — not even Apple.*
- UP TO 18 HOURS OF BATTERY LIFE — MacBook Air delivers incredible battery life with amazing performance, so you can power through a full day of classes without worrying about plugging in.
- A BRILLIANT 13.6-INCH DISPLAY* — The gorgeous Liquid Retina display on MacBook Air supports 1 billion colors, making photos and videos pop with rich contrast and sharp detail, and text appears supercrisp. So everything — from class presentations to movies to games — looks truly stunning.
Build the scheduled-scan mobile configuration profile
Use Microsoft’s complete Intune .mobileconfig example as your production starting point. Do not manually reconstruct only the inner preference fragment: an Intune profile needs the complete Apple configuration-profile wrapper and valid payload identifiers.
The critical payload type is:
<key>PayloadType</key>
<string>com.microsoft.wdav</string>The feature is enabled with:
<key>features</key>
<dict>
<key>scheduledScan</key>
<string>enabled</string>
</dict>A conceptual daily and weekly configuration looks like this:
<key>scheduledScan</key>
<dict>
<key>ignoreExclusions</key>
<true/>
<key>lowPriorityScheduledScan</key>
<true/>
<key>dailyConfiguration</key>
<dict>
<key>timeOfDay</key>
<integer>885</integer>
</dict>
<key>weeklyConfiguration</key>
<dict>
<key>dayOfWeek</key>
<integer>4</integer>
<key>timeOfDay</key>
<integer>880</integer>
<key>scanType</key>
<string>full</string>
</dict>
</dict>This example represents a daily quick scan at 2:45 PM and a weekly full scan on Wednesday at 2:40 PM.
Review two important options
ignoreExclusions set to true makes scheduled scans ignore configured exclusions. That can increase coverage, but it can also increase scan duration and resource usage and may defeat exclusions created for legitimate performance reasons. Make this a deliberate security decision.
lowPriorityScheduledScan set to true favors lower user impact over the fastest possible completion. Test it on representative Apple silicon and Intel Macs before broad deployment.
Save the complete Intune profile as:
com.microsoft.wdav.mobileconfigDo not upload the plain .plist example intended for Jamf or another third-party MDM as if it were an Intune mobile configuration profile. The Intune and Jamf examples on Microsoft’s documentation page are different deployment formats.
Deploy the profile from Intune
- Open the Intune admin center.
- Go to Devices.
- Under Manage devices, select Configuration.
- On the Policies tab, select Create > New policy.
- Set Platform to macOS.
- Set Profile type to Templates.
- Set Template name to Custom, then select Create.
- Enter a profile name and description.
- For Custom configuration profile name, enter exactly:
com.microsoft.wdav - Select the appropriate deployment channel for your macOS management design.
- Upload
com.microsoft.wdav.mobileconfig. - Configure scope tags if your tenant uses them.
- Assign the profile to the test Mac device or user group.
- Review the settings and create the policy.
The name com.microsoft.wdav is not cosmetic. Microsoft warns that Defender will not recognize the preferences if the custom configuration profile name is incorrect. See Microsoft’s Intune deployment guidance.
Rank #3
- AN AMAZING MAC AT A SURPRISING PRICE — With an incredibly portable and durable aluminum design, up to 16 hours of battery life,* and the A18 Pro chip, MacBook Neo is ready to go wherever school takes you.
- FOUR STUNNING COLORS. ONE DURABLE DESIGN — Choose from four beautiful colors — Silver, Blush, Citrus, or Indigo — each with a color-coordinated keyboard. And MacBook Neo is made with a durable recycled aluminum enclosure that helps it reach 60 percent recycled content by weight — the most ever in any Apple product.*
- FLY THROUGH EVERYDAY ASSIGNMENTS — Whether you’re cramming for finals, using Apple Intelligence* to summarize class notes, creating presentations, or even playing the latest Apple Arcade game,* MacBook Neo delivers the performance and AI capabilities you need to get things done.
- UP TO 16 HOURS OF BATTERY LIFE — MacBook Neo delivers all day battery life, so you can power through from early morning classes to late night study sessions without worrying about plugging in.
- A VIBRANT 13-INCH DISPLAY* — The gorgeous Liquid Retina display on MacBook Neo supports 1 billion colors, so photos and videos pop and text is crisp for easy reading.
Policy creation, assignment, delivery, and Defender acceptance are separate events. A policy showing as successfully created in Intune does not prove that a particular Mac has received or applied it. Allow the Mac to check in, then verify the device and configuration-profile status in Intune.
Verify that Defender received the settings
On the Mac, run:
mdatp health --details scheduled_scanThe scheduled-scan settings should show [managed] when they are controlled by the deployed profile. If they are not managed, check delivery and profile construction before repeatedly changing settings locally.
To review completed scans, run:
mdatp scan listThis helps distinguish “the schedule was configured” from “a scan actually completed.”
Sleep, shutdown, and offline behavior
A scheduled scan is not a wake-capable calendar task.
- Mac asleep at the scheduled time: the scan does not run at that exact time; it runs when the Mac resumes from sleep.
- Mac powered off: the scan runs at the next scheduled scan time, rather than automatically running immediately at power-on.
- Mac offline: delivery and verification may be delayed, and the scan’s completion depends on the device being available to Defender.
- Randomization enabled: the scan may start later within the configured randomization window.
Therefore, “daily scan” should not be interpreted as a guarantee that every device scans once on every calendar day.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesIntune Antivirus policy versus the custom scheduled-scan profile
The normal macOS Antivirus policy remains useful for related Defender controls. Microsoft’s current settings reference includes options such as:
- Cloud-delivered protection.
- Automatic security-intelligence updates.
- Enforcement level.
- Scan exclusions.
- Archive scanning.
- Scan-history retention.
- Running a scan after definitions are updated.
- On-demand scan parallelism.
However, the hourly, daily, and weekly schedule configuration described here is deployed through the custom com.microsoft.wdav mobile configuration profile. “Run a scan after definitions are updated” is a separate setting; it does not replace recurring schedules.
Rank #4
- AN AMAZING MAC AT A SURPRISING PRICE — With an incredibly portable and durable aluminum design, up to 16 hours of battery life,* and the A18 Pro chip, MacBook Neo is ready to go wherever school takes you.
- FOUR STUNNING COLORS. ONE DURABLE DESIGN — Choose from four beautiful colors — Silver, Blush, Citrus, or Indigo — each with a color-coordinated keyboard. And MacBook Neo is made with a durable recycled aluminum enclosure that helps it reach 60 percent recycled content by weight — the most ever in any Apple product.*
- FLY THROUGH EVERYDAY ASSIGNMENTS — Whether you’re cramming for finals, using Apple Intelligence* to summarize class notes, creating presentations, or even playing the latest Apple Arcade game,* MacBook Neo delivers the performance and AI capabilities you need to get things done.
- UP TO 16 HOURS OF BATTERY LIFE — MacBook Neo delivers all day battery life, so you can power through from early morning classes to late night study sessions without worrying about plugging in.
- A VIBRANT 13-INCH DISPLAY* — The gorgeous Liquid Retina display on MacBook Neo supports 1 billion colors, so photos and videos pop and text is crisp for easy reading.
Do not use the Windows procedure as a substitute. Microsoft’s Windows scheduled-scan documentation applies to Windows and Windows Server, not to this macOS workflow. For the macOS policy fields, see the Intune macOS Antivirus settings reference.
Troubleshoot common problems
Defender reports unmanaged settings
- Confirm the Intune custom profile name is exactly
com.microsoft.wdav. - Confirm the uploaded file is a valid
.mobileconfig, not a Jamf-only.plist. - Check that the payload type is
com.microsoft.wdav. - Verify assignment to the correct Mac device or user group.
- Check that the Mac has checked in and the profile was delivered.
- Confirm Defender is installed and onboarded.
- Confirm the Platform Update is 101.23122.0005 or newer.
- Look for another MDM or profile overwriting the same preference domain.
- Review whether the selected deployment channel matches your macOS management design.
The mobile configuration file will not upload
Start again from Microsoft’s complete Intune sample. Preserve the outer Configuration payload and the inner com.microsoft.wdav payload, validate the XML, and preserve valid UUID formatting. If duplicating profiles, use distinct payload identifiers to avoid collisions.
Recommended Free Tools
The scan did not start at the expected time
Check the Mac’s local time zone, randomization settings, power state, network availability, scan type, and whether another scan or Defender operation was already active. A full scan may also take substantially longer than a quick scan.
A local CLI change keeps disappearing
When Intune manages a setting, local changes may be overridden during the next policy application. Check management status with:
mdatp health --details scheduled_scanUse Intune as the authoritative configuration source for a managed fleet rather than repeatedly changing the Mac locally.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use the Defender CLI for testing and diagnostics
The mdatp command-line tool is useful for testing a schedule on one Mac, troubleshooting, or validating command syntax before creating an Intune profile. Microsoft documents these commands for Defender version 101.23122.x or later:
sudo mdatp config scheduled-scan settings feature --value enabled
sudo mdatp config scheduled-scan quick-scan hourly-interval --value <arg>
sudo mdatp config scheduled-scan quick-scan time-of-day --value <arg>
sudo mdatp config scheduled-scan weekly-scan
--day-of-week <arg>
--time-of-day <arg>
--scan-type <arg>
sudo mdatp config scheduled-scan settings check-for-definitions --value true
sudo mdatp config scheduled-scan settings low-priority --value true
mdatp scan listThe weekly command rendered in Microsoft’s current documentation appears to omit a space between the --time-of-day and --scan-type arguments. Use separate options as shown above, and verify the syntax supported by the installed Defender build.
Best Value
- FAST RUNS IN THE FAMILY — The 16-inch MacBook Pro with the M5 Pro or M5 Max chip brings next-generation speed and powerful on-device AI to personal, professional, and creative tasks. With all-day battery life, double the starting storage,* and a breathtaking Liquid Retina XDR display, it’s pro in every way.*
- BUCKLE UP — Along with a next-generation CPU, faster unified memory, and up to 2x faster SSD storage,* M5 Pro and M5 Max feature a more powerful GPU with a Neural Accelerator built into each core, delivering faster AI performance and on-device training capabilities. So you can blaze through demanding workloads at mind-bending speeds.
- BUILT FOR AI — Apple silicon, and every major component that powers it, is designed to run demanding on-device AI workloads like LLM inference and training. And Apple Intelligence helps you write, express yourself, and get things done effortlessly with groundbreaking privacy protections at every step.*
- ALL-DAY BATTERY LIFE — MacBook Pro delivers the same exceptional performance whether it’s running on battery or plugged in.*
- MACOS RUNS APPS FAST — All your go-to apps run lightning fast in macOS, including built-in apps like FaceTime and Messages. Plus, built-in virus protection and free software updates help keep your Mac running smoothly and securely.
The CLI is not a replacement for Intune governance. Scripted local settings can drift, be overwritten, and are harder to audit across a fleet.
Production-ready examples
Standard employee fleet
- Daily quick scan at 2:00 AM local time:
timeOfDay=120. - Enable low-priority scanning.
- Keep exclusions respected unless your security policy specifically requires scheduled scans to ignore them.
This is a reasonable balance for laptops that are often idle overnight, although sleeping devices will run the scan on resume.
Large geographically distributed fleet
- Use a daily quick scan at a common local-time window.
- Enable a randomization window of up to two hours.
- Use low-priority scanning where user impact is a concern.
Because schedules use each Mac’s local time, devices in different regions will not all scan at the same UTC time. Randomization further reduces synchronized load.
Higher-risk maintenance group
- Use a weekly full scan during a maintenance period.
- Consider setting
ignoreExclusionstotrueonly after reviewing the performance and security consequences. - Test the policy on both Apple silicon and Intel hardware.
Do not assume this is appropriate for every user laptop. Full scans can affect battery life, CPU utilization, storage activity, and productivity.
When Jamf is the better management path
Intune is the direct fit when the organization already manages Macs through Microsoft’s platform. Apple-focused organizations that already run Jamf Pro may instead deploy Defender’s preference domain through Jamf. Microsoft’s documented Jamf path is Computers > Configuration Profiles, followed by Application & Custom Settings with the com.microsoft.wdav preference domain.
A Jamf-plus-Defender deployment can make sense when Jamf is already the strategic Apple MDM and Defender is the organization’s endpoint-security platform. Adding Jamf solely to schedule Defender scans usually adds another console, license, and policy-conflict risk. Review Jamf Pro and Jamf’s pricing page only if an Apple-first MDM evaluation is part of the wider requirement.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
