Resources For IT Professionals

United States (English) Drop down arrow

Россия (Pусский)中国（简体中文）Brasil (Português)

Post an article

Wikis - Page Details

First published by Andrew Davis [MSFT]
When: 3 Mar 2011 10:52 AM
Last revision by Maheshkumar S Tiwari
When: 12 Sep 2013 6:43 AM
Revisions: 7
Comments: 1

Options

Subscribe to Article (RSS)

Can You Improve This Article?

Positively! Click Sign In to add the tip, solution, correction or comment that will help other users.

Report inappropriate content using these instructions.

Releasing quarantined files using MpCmdRun.exe

In certain scenarios the need may arise to release quarantined files from multiple FEP clients. Logging on to each client and using the FEP UI to release the quarantined files is cumbersome and generally not realistic although it can be done.

MpCmdRun.exe can be used to release quarantined files, MpCmdRun.exe -Restore -Name <name>

For example:

MpCmdRun.exe -Restore -Name RemoteAccess:Win32/RealVNC

The list of valid names can be found on the MMPC Encyclopedia, or in the FCS "Overrides" policy tab under "Overrides based on threat" 'Name' drop-down list.

Note: This can be used with both FCS and FEP 2010.