--- title: "Run a Microsoft Defender Offline scan in Windows 11" canonical: https://saasranked.com/guides/run-defender-offline-scan/ applies_to: Windows 11 (x64), Windows 10, version 1607 or later (x64, x86) checked: 2026-09-11 (against Microsoft's documentation) updated: 2026-09-11 --- # Run a Microsoft Defender Offline scan in Windows 11 - The offline scan runs outside the normal Windows kernel, so it can target malware such as rootkits that try to bypass the Windows shell [2]. - The scan takes about 15 minutes and restarts the PC when it is complete [2]. - It is built into Windows 10, version 1607 or newer, and Windows 11, but it does not apply to ARM versions of Windows 11 or Windows 10 [2]. - If BitLocker is on for the system drive, suspend it first, or you may be asked for the BitLocker recovery key [2]. - The scan needs the Windows Recovery Environment (WinRE). If WinRE is disabled, nothing happens and no error appears [2]. To run a Microsoft Defender Offline scan, open Windows Security, select Virus & threat protection, then Scan options [2]. Select Microsoft Defender Offline scan, then Scan now, and accept the prompts [2]. Save your work first: the PC restarts, scans for about 15 minutes in the Windows Recovery Environment, then restarts into Windows [1][2]. Results appear in Protection history [1]. ## Before you start Save any open files and close running programs. The scan restarts the PC and takes about 15 minutes [2]. The offline scan is built into Windows 11 and Windows 10, version 1607 or newer, on x64 or x86 PCs. It does not apply to ARM versions of Windows 11 or Windows 10 [2]. Microsoft's requirements say you must be signed in with local administrator privileges, and Microsoft Defender Antivirus must be your primary antivirus [2]. If BitLocker is on for the system drive, suspend BitLocker protection first. Otherwise, you may be asked for the BitLocker recovery key when the PC restarts [2]. The scan needs the Windows Recovery Environment (WinRE). If WinRE is disabled, the scan doesn't run and no error message appears [2]. Check the WinRE status with this command [2]: ```cmd reagentc /info ``` If the status is Disabled, turn WinRE on [2]: ```cmd reagentc /enable ``` ## Steps 1. **Open Scan options.** Open the **Windows Security** app. Select **Virus & threat protection**, then choose **Scan options** [2]. 2. **Pick the offline scan.** Select **Microsoft Defender Offline scan**, then select **Scan now** [2]. Microsoft Support names this option **Microsoft Defender Antivirus (offline scan)** [1]. 3. **Save your work.** A prompt asks you to save your work before you continue. When you have saved it, select **Scan** [2]. 4. **Allow the change.** A second prompt asks for permission to make changes to your device. Select **Yes** [2]. 5. **Let the PC restart.** A message says you'll be signed out and Windows will shut down in less than a minute. Microsoft Defender Offline then runs a quick scan in the Windows Recovery Environment [1][2]. 6. **Wait for Windows to load.** The scan takes about 15 minutes. When it is complete, the PC restarts and Windows loads normally [2]. ## Check it worked Open the **Windows Security** app and select **Protection history** to see the offline scan results [1]. To confirm the scan was set up, open **Event Viewer** and go to **Applications and Services Logs** > **Microsoft** > **Windows** > **Windows Defender** > **Operational**. Look for Event ID 2030 with this description: "Microsoft Defender Antivirus downloaded and configured Microsoft Defender Antivirus (offline scan) to run on the next reboot." [2] ## Common problems **Nothing happens after you start the scan.** WinRE is probably disabled. Run `reagentc /info`, and if the status is Disabled, run `reagentc /enable` [2]. **The PC asks for a BitLocker recovery key.** BitLocker protection was on when the PC restarted into the offline environment. Suspend BitLocker protection before you run the scan again [2]. **There is no offline scan on your device.** Microsoft Defender Offline does not apply to ARM versions of Windows 11 or Windows 10, or to Windows Server [2]. **You can't get updates for the offline scan.** Microsoft Defender Antivirus must be your primary antivirus, not in passive mode [2]. ## Questions **How long does a Microsoft Defender Offline scan take?** About 15 minutes. When the scan is complete, the PC restarts and Windows loads normally [2]. **Where do I find the offline scan results?** Open the Windows Security app and select Protection history [1]. **Can I start an offline scan from PowerShell?** Yes. The Start-MpWDOScan cmdlet starts a Microsoft Defender Offline scan and reboots the device into an isolated environment. Save your files first [2]. **When should I run an offline scan?** Run it if you think your device has been exposed to malware or a virus, or if you want to scan without an Internet connection [1]. ## Sources 1. [Virus and Threat Protection in the Windows Security App](https://support.microsoft.com/en-us/windows/help-protect-my-pc-with-microsoft-defender-offline-9306d528-64bf-4668-5b80-ff533f183d6c), Microsoft Support, accessed 2026-09-11 2. [Microsoft Defender Offline scan in Windows](https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-offline), Microsoft Learn, accessed 2026-09-11 Checked against Microsoft's documentation on 11 Sept 2026.