One example of how MpCmdRun could be useful is a scenario where your WSUS infrastructure has gone offline and you want to temporarily force your clients to pull a definition from an alternate source without modifying the SCEP policy.

In this case, you would need to either manually enter the following command or create a script that contains the command:

MpCmdRun –signatureupdate –servername\sharename

The -restore option can utilized to restore files that have been erroneously quarantined, without having to directly access the client UI. This could be done remotely using a tool such as PsExec.

MpCmdRun automatically creates a logfile called MpCmdRun.log in the directory C:\Users\username\AppData\Local\Temp. This logfile records any commands that are executed using MpCmdRun.exe.