COMMAND EVERYTHING.

Get-MpPerformanceReport

This cmdlet reports the file paths, file extensions, and processes that cause the highest impact to Microsoft Defender Antivirus scans.

Networking / Security · Risk: Low · Documentation Verified

Last verified: 2026-10-26

Microsoft DefenderPerformance reference: This cmdlet reports the file paths, file extensions, and processes that cause the highest impact to Microsoft Defender Antivirus scans. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.

Get-MpPerformanceReport [-Path] <String> [-TopFiles <Int32>] [-TopScansPerFile <Int32>]
 [-TopProcessesPerFile <Int32>] [-TopScansPerProcessPerFile <Int32>] [-TopPaths <Int32>]
 [-TopPathsDepth <Int32>] [-TopScansPerPath <Int32>] [-TopFilesPerPath <Int32>]
 [-TopScansPerFilePerPath <Int32>] [-TopExtensionsPerPath <Int32>]
 [-TopScansPerExtensionPerPath <Int32>] [-TopProcessesPerPath <Int32>]
 [-TopScansPerProcessPerPath <Int32>] [-TopExtensions <Int32>] [-TopScansPerExtension <Int32>]
 [-TopPathsPerExtension <Int32>] [-TopScansPerPathPerExtension <Int32>]
 [-TopFilesPerExtension <Int32>] [-TopScansPerFilePerExtension <Int32>]
 [-TopProcessesPerExtension <Int32>] [-TopScansPerProcessPerExtension <Int32>]
 [-TopProcesses <Int32>] [-TopScansPerProcess <Int32>] [-TopFilesPerProcess <Int32>]
 [-TopScansPerFilePerProcess <Int32>] [-TopExtensionsPerProcess <Int32>]
 [-TopScansPerExtensionPerProcess <Int32>] [-TopPathsPerProcess <Int32>]
 [-TopScansPerPathPerProcess <Int32>] [-TopScans <Int32>] [-MinDuration <String>]
 [-MinStartTime <DateTime>] [-MinEndTime <DateTime>] [-MaxStartTime <DateTime>]
 [-MaxEndTime <DateTime>] [-Overview] [-Raw] [<CommonParameters>]

Copied 0 times

Required permissions

Use an account with the target resource permissions documented for Get-MpPerformanceReport. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.

Supported environments

Windows / DefenderPerformance · Windows Server 2025 documentation; feature/module prerequisites apply

Parameters

-MaxEndTime: Specifies the maximum end time of scans included in the report. Accepts a valid DateTime.
-MaxStartTime: Specifies the maximum start time of scans included in the report. Accepts a valid DateTime.
-MinDuration: Specifies the minimum duration of any scans or total scan durations of files, extensions and processes included in the report. Accepts values like '0.1234567sec' or '0.1234ms' or '0.1us' or a valid TimeSpan.
-MinEndTime: Specifies the minimum end time of scans included in the report. Accepts a valid DateTime.
-MinStartTime: Specifies the minimum start time of scans included in the report. Accepts a valid DateTime.
-Overview: Adds an overview or summary of the scans captured in the trace to the regular output.
-Path (required): Specifies the location of Microsoft Defender Antivirus performance recording to analyze.
-Raw: Specifies that the output should be machine readable and readily convertible to serialization formats like JSON. - Collections and elements are not be formatted. - TimeSpan values are represented as number of 100-nanosecond intervals. - DateTime values are represented as number of 100-nanosecond intervals since January 1, 1601 (UTC).
-TopExtensions: Requests a top extensions report and specifies how many top extensions to output, sorted by "Duration".
-TopExtensionsPerPath: Specifies how many top extensions to output for each top path, sorted by "Duration".
-TopExtensionsPerProcess: Specifies how many top extensions to output for each top process, sorted by "Duration".
-TopFiles: Requests a top files report and specifies how many top files to output, sorted by "Duration".
-TopFilesPerExtension: Specifies how many top files to output for each top extension, sorted by "Duration".
-TopFilesPerPath: Specifies how many top files to output for each top path, sorted by "Duration".
-TopFilesPerProcess: Specifies how many top files to output for each top process, sorted by "Duration".
-TopPaths: Requests a top paths report and specifies how many top entries to output, sorted by "Duration". This is called recursively for each directory entry. Scans are grouped hierarchically per folder and sorted by "Duration".

Prerequisites

Windows with the DefenderPerformance module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.

Security considerations

This is a read-oriented cmdlet; protect any sensitive results and check the documented effects of your selected parameters.

Examples

EXAMPLE 1

Get-MpPerformanceReport -Path:.\Defender-scans.etl -TopFiles:10 -TopExtensions:10 -TopProcesses:10 -TopScans:10

Documented invocation from the Microsoft DefenderPerformance reference. Replace the example target values with values for your environment. Source: Microsoft, CC BY 4.0; transcript prompt/output removed. This example was not executed.

Sources

https://github.com/MicrosoftDocs/windows-powershell-docs/blob/b7645dd8c687139b28e845119da30ec670526507/docset/winserver2025-ps/DefenderPerformance/Get-MpPerformanceReport.md

https://learn.microsoft.com/powershell/module/defenderperformance/get-mpperformancereport?view=windowsserver2025-ps

Personal collections

Explain or customize this command with AI

Related commands

Get-NetIPInterface

Add-MpPreference

Add-DhcpServerInDC

Add-DnsClientDohServerAddress