How to do offline virus scan with Microsoft Defender on Windows 11

If your device gets hit by a nasty malware, Microsoft Defender Offline can detect and remove it – here's how on Windows 11.

Windows 11 Defender Offline scan
Windows 11 Defender Offline scan
  • To offline virus scan on Windows 11, open Windows Security > Virus & threat protection, click “Scan options,” select “Microsoft Defender Offline” scan.
  • After the scan, you can find the Microsoft Defender Offline scan results on Windows Security > Virus & threat protection > Protection history.

Although Windows 11 is a secure system, you may sometimes come across malware or other malicious software that would be difficult to remove while the operating system is running.

If this is the case, you can use the “Microsoft Defender Offline” feature to scan and remove virtually any type of malware, including viruses, rootkits, ransomware, and other malicious software that may be hard to delete while Windows 11 is running.

This guide will teach you how to use the Microsoft Defender Offline scan to detect and remove highly persistent malware. (The offline scan feature is also available on Windows 10.)

Perform offline virus scan on Windows 11

To perform a full offline virus scan on Windows 11, use these steps:

  1. Open Windows Security.

  2. Click on Virus & threat protection.

  3. Under the “Current threats” section, click on Scan options.

    Open scan options

  4. Check the “Microsoft Defender Offline scan” option.

    Microsoft Defender Offline scan

  5. Click the Scan now button.

  6. Click the Scan button.

Once you complete the steps, the computer will restart automatically in the recovery environment, and Microsoft Defender will start the full virus scan. If the Windows 11 antivirus detects any virus, rootkit, or any other type of malware, it’ll remove it automatically.

After the scan, you can find the Microsoft Defender Offline scan results on Windows Security > Virus & threat protection > Protection history.

About the author

Mauro Huculak is a Windows How-To Expert who started Pureinfotech in 2010 as an independent online publication. He has also been a Windows Central contributor for nearly a decade. Mauro has over 15 years of experience writing comprehensive guides and creating professional videos about Windows and software, including Android and Linux. Before becoming a technology writer, he was an IT administrator for seven years. In total, Mauro has over 21 years of combined experience in technology. Throughout his career, he achieved different professional certifications from Microsoft (MSCA), Cisco (CCNP), VMware (VCP), and CompTIA (A+ and Network+), and he has been recognized as a Microsoft MVP for many years. You can follow him on X (Twitter), YouTube, LinkedIn and About.me. Email him at [email protected].