Skip to content
HOW BISCUITPractical guides

Explore How Biscuit

Search How Biscuit

Enter a word or phrase to search.
Category: Home Tech Topic: Privacy & Security Type: Guide

How to Run a Microsoft Defender Offline Scan in Windows 11

Defender Offline scans outside the normal Windows kernel, where some rootkits and persistent malware have less opportunity to hide or interfere.

Updated 4 min read Researched Not hands-on tested

What to know

  • Defender Offline scans outside the normal Windows kernel, where some rootkits and persistent malware have less opportunity to hide or interfere.
  • Save your work, update Defender, run the offline scan, review Protection history, and follow with account and system checks.

Open:

Windows Security → Virus & threat protection → Scan options

Select:

Microsoft Defender Offline scan → Scan now

Save all open work first.

The computer will restart, scan from the Windows Recovery Environment, and restart into Windows when the scan finishes.

When an offline scan is useful

Use Defender Offline when:

  • The same malware repeatedly returns
  • Windows Security recommends it
  • A rootkit or boot-level infection is suspected
  • A serious outbreak was recently cleaned
  • Malware appears to interfere with normal scans
  • A full scan does not explain persistent symptoms

Microsoft says Defender Offline runs outside the normal Windows kernel so it can target threats that attempt to hide from the Windows shell, including some rootkits and master-boot-record infections.

Do not run repeated offline scans as a substitute for investigating a stolen account, compromised browser extension, malicious remote-access session, or unsafe backup.

Update Windows Security first

Open:

Windows Security → Virus & threat protection → Protection updates

Check for updates.

Also install current Windows updates where practical.

An offline scan depends on Microsoft Defender’s available security intelligence and the functioning Windows recovery environment.

Preserve evidence when the incident is serious

Before cleaning a business, legal, financial, or investigative system:

  • Photograph alerts
  • Record file names
  • Record detection names
  • Preserve email headers
  • Record suspicious domains
  • Note times
  • Save payment and scam communications
  • Contact the appropriate incident-response professional

Cleaning can alter forensic evidence.

A household malware problem and a corporate breach are not the same project merely because both contain the word “virus.”

Save work and close applications

The scan restarts the computer.

Save:

  • Documents
  • Browser work
  • Terminal sessions
  • Unsaved forms
  • Application state

Pause large file transfers.

Disconnect external drives that do not need to be scanned, particularly backup drives.

Start the offline scan

  1. Open Windows Security.
  2. Select Virus & threat protection.
  3. Select Scan options.
  4. Select Microsoft Defender Offline scan.
  5. Select Scan now.
  6. Approve the restart.

Microsoft also provides the administrative PowerShell command:

Start-MpWDOScan

The command starts the same offline scan and causes the PC to restart.

Use the graphical interface unless there is a genuine administrative reason to use PowerShell.

What happens during the scan

Windows restarts into a separate trusted environment.

Defender performs its scan without loading the ordinary Windows desktop and its normal startup applications.

The machine then restarts into Windows automatically.

Do not interrupt power.

Keep a laptop connected to its charger.

Review Protection history

After signing back in:

  1. Open Windows Security.
  2. Select Virus & threat protection.
  3. Open Protection history.
  4. Review detected or remediated items.
  5. Expand each relevant entry.
  6. Record the detection name and action.

Do not restore a quarantined item merely because an application stopped working.

Confirm that the file is legitimate through the software vendor or a qualified analyst.

Run another normal scan

After the offline scan:

  • Update Defender again.
  • Run a full scan.
  • Update browsers and applications.
  • Review installed programs.
  • Review startup applications.
  • Review browser extensions.
  • Check remote-access software.
  • Review account sessions.

Microsoft distinguishes quick, full, custom, and offline scans; they answer related but not identical questions.

Change credentials from a trusted device

When malware may have stolen passwords, tokens, cookies, or authentication secrets:

  1. Use another known-clean device.
  2. Change the primary email password first.
  3. Change financial and cloud passwords.
  4. Revoke existing sessions.
  5. Replace recovery codes.
  6. Review multifactor methods.
  7. Remove unknown devices.
  8. Notify financial institutions where necessary.

Removing the malware does not invalidate information the attacker already copied.

A clean scan does not prove the PC is clean

Defender Offline can miss:

  • A new or unknown threat
  • A compromised online account
  • A malicious browser extension
  • Firmware compromise
  • A threat stored only on another device
  • Data already stolen
  • Social-engineering access
  • Legitimate remote-control software used maliciously

When compromise involved administrator access, credential theft, ransomware, or unknown persistence, a clean Windows reinstall may be more trustworthy than an escalating sequence of increasingly hopeful scans.

When the scan does not start

Check:

  • Windows updates
  • Windows Security health
  • Recovery environment
  • Device-management policy
  • Third-party antivirus
  • BitLocker recovery access
  • Free storage
  • Event logs

Microsoft supports Defender Offline as an on-demand scanner even alongside some real-time security products, but organization policy and product configuration can affect availability.

Do not disable security software blindly.

Bottom line

Save your work, update Defender, run the offline scan, review Protection history, and follow with account and system checks.

The offline environment gives malware fewer places to hide. It does not travel backward in time and retrieve the passwords the malware may already have stolen.

Sources reviewed

Limits and cautions

  • Not hands-on tested
Sources reviewed

Source notes

  1. https://support.microsoft.com/en-us/windows/security/threat-malware-protection/virus-and-threat-protection-in-the-windows-security-appsupport.microsoft.com
  2. https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-offlinelearn.microsoft.com
  3. https://learn.microsoft.com/en-us/powershell/module/defender/start-mpwdoscanlearn.microsoft.com

See something wrong or out of date? Report a correction.