How to Run Windows Defender Offline Scan in Windows 11

This guide explains how to run a Microsoft Defender Offline scan in Windows 11 to remove highly persistent threats such as rootkits, bootkits, and sophisticated malware. Some malicious programs can bypass active system defenses or lock files while the operating system is running. Microsoft Defender Offline solves this by restarting your PC into a dedicated, isolated recovery environment, allowing the antivirus engine to scan and clean your drives before any malware can load into memory.

Why Use Microsoft Defender Offline?

Standard antivirus scans operate within the live Windows environment. Advanced malware can mask its processes, inject code into system drivers, or block security software from functioning correctly. Running an offline scan loads a clean Windows Preinstallation Environment (WinPE) equipped with the latest security definitions, ensuring that malware remains inactive and undetectable defenses are neutralized.

What to Know Before Starting

• Save your work: The process requires an immediate system restart.
• Duration: The scan typically takes between 10 to 20 minutes to complete.
• Automatic process: Once the scan finishes, Windows 11 will automatically reboot back to your standard desktop.

Method 1: Run the Scan via Windows Security (Settings)

1. Click the Start button and open Settings (or press Win + I).
2. In the left sidebar, select Privacy & security.
3. Click on Windows Security in the right pane.
4. Click the Open Windows Security button.
5. Select Virus & threat protection.
6. Under the Current threats section, click on Scan options.
7. Scroll down, select Microsoft Defender Antivirus (offline scan), and click Scan now.
8. A prompt will appear asking to save your work; click Scan to confirm.
9. Click Yes on the User Account Control (UAC) prompt.

Your PC will restart automatically and initiate the offline scan interface.

Method 2: Run the Scan via PowerShell

For advanced users or administrators, you can trigger the scan using an elevated PowerShell command:

1. Right-click the Start button and select Terminal (Admin) or search for PowerShell, right-click it, and select Run as administrator.

2. Type the following command and press Enter:

   Start-MpWDOScan

3. Your computer will automatically reboot and start the offline scan.

How to View Offline Scan Results

After the scan completes and your computer boots back into Windows 11:

1. Open Windows Security (search for it in the Start menu).
2. Click Virus & threat protection.
3. Click Protection history.
4. Review the log to see any threats detected, quarantined, or removed during the offline scan.