The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

On-demand scan command line interface

  • Published on Sep 14, 2026
  • 3 minute(s) read
Prev Next

With the on-demand scan command line interface, you can start, stop, pause, resume, and get status for quick, full, and custom on-demand scans from the command line or as part of a batch file. All users can start a scan and check the status of a scan, regardless of the interface mode for the Trellix Endpoint Security (ENS) Client.

Prerequisites

  • The Threat Prevention service (mfetp.exe) must already be running for amcfg.exe to run.

  • The interface mode for the Trellix Endpoint Security (ENS) Client must be set to Full access if a user wants to stop, pause or resume an on-demand scan through command line.

Syntax: On-demand scan command line interface

The on-demand scan syntax for amcfg.exe is:

 installation_path\amcfg.exe /scan /task [ command_args ]

  • installation_path — C:\Program Files\McAfee\Endpoint Security\Threat Prevention by default

  • command_args— One of the commands in the On‑demand scan command arguments table

Arguments can appear in any order, except that you must keep each argument with its value.

The scan is executed only if all values are correct. Otherwise, amcfg.exe displays a message with the possible values and doesn't run the scan. If the command line includes multiple values for an argument, the scan runs using only the first value. The scanner ignores any invalid configuration arguments.

On-demand scan command arguments

Argument

Value

Description

/task

  • quick — Runs the default Quick Scan.

  • full — Runs the default Full Scan.

  • custom_scan_ID — Runs a custom scan with the specified ID.

    To get a list of scan IDs for the custom scans that are currently defined, run amcfg.exe /scan /list.

Specifies the type of scan task to run.

If you enter amcfg.exe /scan (without specifying /task), a Quick Scan starts by default.

/action

  • cancel — Stops the currently running scan, if applicable.

  • pause — Pauses the currently running scan, if applicable.

    Note

    When a scan is paused, if you run /action start for the same scan, the scan starts again from the beginning. Use resume to continue a paused scan.

  • resume — Continues a paused scan, if applicable.

  • start — Starts the scan.

  • status — Displays the status of the last scan of the specified type. Check the log file for information about any detections.

Specifies the scan action to apply to the previously specified /task.

Note

The /task argument is required with the /action argument.

All users can start a scan and check the status of a scan, regardless of the interface mode for the Trellix Endpoint Security (ENS) Client.

Note

Avoid using other arguments while executing /action status for the custom scan.



Examples: On-demand scan command line interface

Open a command prompt and change to the installation location of amcfg.exe to run these example commands. By default, amcfg.exe is located in the C:\Program Files\McAfee\Endpoint Security\Threat Prevention folder.

To...

Run this command

Start a Quick Scan.

amcfg.exe /scan

amcfg.exe /scan /task quick /action start

Display the status of a Quick Scan.

amcfg.exe /scan /task quick /action status

Pause the currently running Quick Scan.

amcfg.exe /scan /task quick /action pause

Resume the currently paused Quick Scan.

amcfg.exe /scan /task quick /action resume

Stop a Quick Scan.

amcfg.exe /scan /task quick /action cancel

Start a Full Scan.

amcfg.exe /scan /task full /action start

Display the status of a Full Scan.

amcfg.exe /scan /task full /action status

Pause the currently running Full Scan.

amcfg.exe /scan /task full /action pause

Resume the currently paused Full Scan.

amcfg.exe /scan /task full /action resume

Stop a Full Scan.

amcfg.exe /scan /task full /action cancel

Display a list of defined custom scan names and their scan IDs.

amcfg.exe /scan /list

Start a custom scan with the specified ID.

amcfg.exe /scan /task scan_ID /action start

Display the status of a custom scan with the specified ID.

amcfg.exe /scan /task scan_ID /action status

Pause the currently running custom scan with the specified ID.

amcfg.exe /scan /task scan_ID /action pause

Resume the currently paused custom scan with the specified ID.

amcfg.exe /scan /task scan_ID /action resume

Stop a custom scan with the specified ID.

amcfg.exe /scan /task scan_ID /action cancel

Related articles