saasrankedSoftware, ranked on the facts

Run a Microsoft Defender Offline scan in Windows 11

Applies to Windows 11 (x64), Windows 10, version 1607 or later (x64, x86) · 20 min · Beginner · Needs an administrator account
Checked against Microsoft's documentation on 11 Sept 2026

In short

  • The offline scan runs outside the normal Windows kernel, so it can target malware such as rootkits that try to bypass the Windows shell2.
  • The scan takes about 15 minutes and restarts the PC when it is complete2.
  • It is built into Windows 10, version 1607 or newer, and Windows 11, but it does not apply to ARM versions of Windows 11 or Windows 102.
  • If BitLocker is on for the system drive, suspend it first, or you may be asked for the BitLocker recovery key2.
  • The scan needs the Windows Recovery Environment (WinRE). If WinRE is disabled, nothing happens and no error appears2.

To run a Microsoft Defender Offline scan, open Windows Security, select Virus & threat protection, then Scan options2. Select Microsoft Defender Offline scan, then Scan now, and accept the prompts2. Save your work first: the PC restarts, scans for about 15 minutes in the Windows Recovery Environment, then restarts into Windows1,2. Results appear in Protection history1.

Before you start

Save any open files and close running programs. The scan restarts the PC and takes about 15 minutes2.

The offline scan is built into Windows 11 and Windows 10, version 1607 or newer, on x64 or x86 PCs. It does not apply to ARM versions of Windows 11 or Windows 102. Microsoft's requirements say you must be signed in with local administrator privileges, and Microsoft Defender Antivirus must be your primary antivirus2.

If BitLocker is on for the system drive, suspend BitLocker protection first. Otherwise, you may be asked for the BitLocker recovery key when the PC restarts2.

The scan needs the Windows Recovery Environment (WinRE). If WinRE is disabled, the scan doesn't run and no error message appears2. Check the WinRE status with this command2:

Command Prompt
reagentc /info

If the status is Disabled, turn WinRE on2:

Command Prompt
reagentc /enable

Steps

  1. Open Scan options. Open the Windows Security app. Select Virus & threat protection, then choose Scan options2.
  2. Pick the offline scan. Select Microsoft Defender Offline scan, then select Scan now2. Microsoft Support names this option Microsoft Defender Antivirus (offline scan)1.
  3. Save your work. A prompt asks you to save your work before you continue. When you have saved it, select Scan2.
  4. Allow the change. A second prompt asks for permission to make changes to your device. Select Yes2.
  5. Let the PC restart. A message says you'll be signed out and Windows will shut down in less than a minute. Microsoft Defender Offline then runs a quick scan in the Windows Recovery Environment1,2.
  6. Wait for Windows to load. The scan takes about 15 minutes. When it is complete, the PC restarts and Windows loads normally2.

Check it worked

Open the Windows Security app and select Protection history to see the offline scan results1.

To confirm the scan was set up, open Event Viewer and go to Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational. Look for Event ID 2030 with this description: "Microsoft Defender Antivirus downloaded and configured Microsoft Defender Antivirus (offline scan) to run on the next reboot."2

Common problems

Nothing happens after you start the scan. WinRE is probably disabled. Run reagentc /info, and if the status is Disabled, run reagentc /enable2.

The PC asks for a BitLocker recovery key. BitLocker protection was on when the PC restarted into the offline environment. Suspend BitLocker protection before you run the scan again2.

There is no offline scan on your device. Microsoft Defender Offline does not apply to ARM versions of Windows 11 or Windows 10, or to Windows Server2.

You can't get updates for the offline scan. Microsoft Defender Antivirus must be your primary antivirus, not in passive mode2.

Questions

How long does a Microsoft Defender Offline scan take?
About 15 minutes. When the scan is complete, the PC restarts and Windows loads normally2.
Where do I find the offline scan results?
Open the Windows Security app and select Protection history1.
Can I start an offline scan from PowerShell?
Yes. The Start-MpWDOScan cmdlet starts a Microsoft Defender Offline scan and reboots the device into an isolated environment. Save your files first2.
When should I run an offline scan?
Run it if you think your device has been exposed to malware or a virus, or if you want to scan without an Internet connection1.

11 Sept 2026: Published.

Sources

  1. Virus and Threat Protection in the Windows Security App, Microsoft Support. Accessed 11 Sept 2026.
  2. Microsoft Defender Offline scan in Windows, Microsoft Learn. Accessed 11 Sept 2026.