Just an update, after setting up a mail server to send ecar test viruses through easily to our primary server, Windows defender picks them up if I copy to the desktop or manually scan the file, but in an email, it reports no threats. So clearly the scanner is not working properly.