How to do offline virus scan with Microsoft Defender on Windows 11

If your device gets hit by a nasty malware, Microsoft Defender Offline can detect and remove it – here's how on Windows 11.

Windows 11 Defender Offline scan
Windows 11 Defender Offline scan
  • To offline virus scan on Windows 11, open Windows Security > Virus & threat protection, click “Scan options,” select “Microsoft Defender Offline” scan.
  • After the scan, you can find the Microsoft Defender Offline scan results on Windows Security > Virus & threat protection > Protection history.

Although Windows 11 is a secure system, you may sometimes come across malware or other malicious software that would be difficult to remove while the operating system is running.

If this is the case, you can use the “Microsoft Defender Offline” feature to scan and remove virtually any type of malware, including viruses, rootkits, ransomware, and other malicious software that may be hard to delete while Windows 11 is running.

This guide will teach you how to use the Microsoft Defender Offline scan to detect and remove highly persistent malware. (The offline scan feature is also available on Windows 10.)

Perform offline virus scan on Windows 11

To perform a full offline virus scan on Windows 11, use these steps:

  1. Open Windows Security.

  2. Click on Virus & threat protection.

  3. Under the “Current threats” section, click on Scan options.

    Open scan options

  4. Check the “Microsoft Defender Offline scan” option.

    Microsoft Defender Offline scan

  5. Click the Scan now button.

  6. Click the Scan button.

Once you complete the steps, the computer will restart automatically in the recovery environment, and Microsoft Defender will start the full virus scan. If the Windows 11 antivirus detects any virus, rootkit, or any other type of malware, it’ll remove it automatically.

After the scan, you can find the Microsoft Defender Offline scan results on Windows Security > Virus & threat protection > Protection history.

About the author

Mauro Huculak is a Windows How-To Expert and founder of (est. 2010). With over 21 years as a technology writer and IT Specialist, Mauro specializes in Windows, software, and cross-platform systems such as Linux, Android, and macOS.

Certifications: Microsoft Certified Solutions Associate (MCSA), Cisco Certified Network Professional (CCNP), VMware Certified Professional (VCP), and CompTIA A+ and Network+.

Mauro is a recognized Microsoft MVP and has also been a long-time contributor to Windows Central.

You can follow him on YouTube, Threads, BlueSky, X (Twitter), LinkedIn and About.me. Email him at [email protected].