On Windows 11 (and 10), Microsoft Defender Antivirus is a security feature that protects your computer and data from virtually any type of malware and hackers. Although this is one of the best antivirus software, it's not perfect, and sometimes, specially crafted malicious code can find its way into the system, rapidly take control, and cause irreversible damage.
This is not specific to Microsoft Defender. It can occur with any third-party antivirus you install on your computer. However, if your device gets infected with nasty, hard-to-move malware when Windows is loaded, you can use the Microsoft Defender Offline scan option. The offline option is an automated feature capable of running when the system isn't active, which allows the anti-malware engine to detect and remove most viruses more easily.
In this how-to guide, I will explain how to perform an offline malware scan using Microsoft Defender Antivirus, whether you have a computer running Windows 11 (or Windows 10).
How to use Defender Antivirus Offline scan on Windows 10
To scan and remove viruses with the Microsoft Defender Antivirus Offline scan feature, use these steps:
- Open Start.
- Search for Windows Security and click the top result to open the app.
- Click on Virus & threat protection.
- Click the Scan options setting under the "Current threats" section.
- Select the "Microsoft Defender Offline scan" option.
- Click the Scan now button.
- Click the Scan button.
Once you complete the steps, Windows 11 will restart into the Windows Recovery Environment (WinRE), where the command-line version of the antivirus will run automatically without loading the system.
The scan will detect and delete any hard-to-remove viruses it may find without user interaction. The offline scan will take around 10 minutes, then the computer will restart automatically.
Review scan results
To review the scan information, use these steps:
- Open Start.
- Search for Windows Security and click the top result to open the app.
- Click on Virus & threat protection.
- Click the Protection history setting under the "Current threats" section.
- Confirm the scan actions and recommendations (if available).
If you cannot find any information in the history, the antivirus software didn't detect any malware on your computer.
It's also important to pay attention to the items' dates because the list includes all the recent actions, and sometimes, you may see things from previous scans or real-time detections.
More resources
For more helpful articles, coverage, and answers to common questions about Windows 10 and Windows 11, visit the following resources:
- Windows 11 on Windows Central — All you need to know
- Windows 10 on Windows Central — All you need to know
Once you complete the steps, Windows 11 will restart into the Windows Recovery Environment (WinRE), where the command-line version of the antivirus will run automatically without loading the system. The scan will detect and delete any hard-to-remove viruses it may find without user interaction. The offline scan will take around 10 minutes, then the computer will restart automatically.
