Share via

Releasing quarantined files using MpCmdRun.exe

  • Article

In certain scenarios the need may arise to release quarantined files from multiple FEP clients. Logging on to each client and using the FEP UI to release the quarantined files is cumbersome and generally not realistic although it can be done.

MpCmdRun.exe can be used to release quarantined files, MpCmdRun.exe -Restore -Name <name>
**
**

For example:

MpCmdRun.exe -Restore -Name RemoteAccess:Win32/RealVNC
**
**

The list of valid names can be found on the MMPC Encyclopedia, or in the FCS "Overrides" policy tab under "Overrides based on threat" 'Name' drop-down list.

Note: This can be used with both FCS and FEP 2010.