Microsoft Defender Offline Scan Options For Windows PCs HTMD Blog

Let’s learn how to use Microsoft Defender Offline Scan Options for Windows PCs. Do you know what Microsoft Defender Offline does? Microsoft Defender Offline is an antimalware scanning tool- one of the most powerful tools for scanning and removing malware.

Microsoft Defender Offline can run on Windows 10 and Windows 11 versions. In previous versions, users had to install it. This type of scanning will secure the PC. The scanning runs outside the normal Windows kernel to target malware that infects or overwrites the master boot record (MBR).

Microsoft Defender Offline will secure the PC if the user suspects a malware infection on their PC with a scanning procedure. Microsoft Defender will help scan and remove malware from your Windows PC using Microsoft Defender Antivirus.

Microsoft Defender Offline scan ensures the PC’s security. It scans in a trusted environment without starting the Operating System. This tool secures the operating system with just one click. In this article, you will learn how to run a Microsoft Defender Offline scan in Windows 11.

What are the Advantages of Microsoft Defender Offline Scan?

Secure PC with Microsoft Defender Offline in Windows

Microsoft Defender Offline is a tool that lets you scan your PC from a trusted environment. This tool is beneficial in removing malware even though it tries to hide from normal antivirus software like rootkits or other highly persistent malware.

There are many advantages to this tool; they are:

1. This tool helps the user to scan and remove malware from your Windows PC
2. It can run automatically if Windows Security detects a malware infection
3. You can run the scanning manually
4. It uses the most recent protection updates available on the endpoint
5. The scanning is done by just one click directly from the Windows Security app

Microsoft Defender Offline Scan Options for Windows PCs

Secure PC with Microsoft Defender offline is the best tool for securing the system from malware. If you suspect malware is hiding and security software did not find it, you can run a Microsoft Defender offline scan. There are 3 ways to run Microsoft Defender offline.

Number of Methods For Run Microsoft Defender Offline	Methods
Method 1	The Windows Security
Method 2	PowerShell
Method 3	Windows Management Instrumentation (WMI)

Microsoft Defender Offline Scan Options for Windows PCs – Table.1

1. The Windows Security

Using the Windows security Method is an easy process; if you are Running scanning through this option or any other option, first, you have to save all your working data and shut down running programs. Then Open the Windows Security by searching the Start menu.

Open Settings > Update & Security > Privacy and Security
Click on the Windows Security option
Click on the option Virus & Threat Protection in the Windows Security

Microsoft Defender Offline Scan Options for Windows PCs - Fig. 1 — Microsoft Defender Offline Scan Options for Windows PCs – Fig. 1

Windows 11 Security Feature Blocking NTLM over SMB for Advanced Threat Protection

After Clicking the Virus & Threat Protection option, you will get the Virus & Threat Protection window. On that window is an option called Current Threats; under the Current Threats, select Scan options.

Microsoft Defender Offline Scan Options for Windows PCs - Fig. 2 — Microsoft Defender Offline Scan Options for Windows PCs – Fig.2

In the Scan options, there are 2 other options for scanning your PC: Quick Scan, Full Scan, Customised Scan, and Microsoft Defender Antivirus(Offline Scan). Click on the Microsoft Defender Antivirus(Offline Scan).

Scan Options	Used to
Quick Scan	Check Folders in your system where threats are commonly found
Full Scan	Check all files and running programs on your hard disk. This scan could take longer than one hour.
Customised Scan	Choose which files and locations you want to check
Microsoft Defender Antivirus(Offline Scan)	Some malicious software can be particularly difficult to remove from your device. Microsoft Defender Antivirus(Offline Scan) can help find and remove them using up-to date threat definitions. This will restart your device and will take about 15 minutes.

Microsoft Defender Offline Scan Options for Windows PCs – Table.2

Microsoft Defender Offline Scan Options for Windows PCs - Fig. 3 — Microsoft Defender Offline Scan Options for Windows PCs – Fig.3

Click on the Microsoft Defender Antivirus(Offline Scan), and the scan will help you find and remove them using up-to-date threat definitions. Click on the Scan Now option.

Microsoft Defender Offline Scan Options for Windows PCs - Fig. 4 — Microsoft Defender Offline Scan Options for Windows PCs – Fig.4

After clicking the Scan Now option, you will see another window containing information about Microsoft Defender antivirus (Offline Scan). Your device will restart, which will take some time. Save all work before continuing. The scan will take almost 15 minutes to complete.

Click on the Scan option

Microsoft Defender Offline Scan Options for Windows PCs - Fig. 5 — Microsoft Defender Offline Scan Options for Windows PCs – Fig.5

2. Use PowerShell to Run an Offline Scan

Another way is to use Powershell. First, you must open Windows Powershell as an administrator. Then, type the command given below and run Microsoft Defender Offline. After copying this command into Powershell, press Enter.

Copy – Start-MpWDOScan

This command will start a Microsoft Defender offline scan on your device. The system will restart and boot into the Microsoft Defender Offline scanner during the scan. After the scan, the system will automatically reboot into the operating system.

Microsoft Defender Offline Scan Options for Windows PCs - Fig.6 — Microsoft Defender Offline Scan Options for Windows PCs – Fig.6

3. Use Windows Management Instrumentation (WMI) to Run an Offline Scan

Using Windows Management Instrumentation (WMI) to Run an Offline scan is to use the MSFT_MpWDOScan class for this. This class allows you to start a Microsoft Defender Offline scan, which will reboot the endpoint and scan it from a trusted environment.

WMI script snippet will quickly run a Microsoft Defender Offline scan, you can use the following WMI script snippet that will help you.

Microsoft Defender Offline Scan Options for Windows PCs - Fig .7 — Microsoft Defender Offline Scan Options for Windows PCs – Fig .7

Copy- wmic /namespace:\root\Microsoft\Windows\Defender path MSFT_MpWDOScan call Start

End Result – Microsoft Defender Offline in Windows

Let’s check the end results of the MS Defender Offline scan for Windows devices. This will happen during the reboot after running any of the above commands.

Microsoft Defender Offline Scan Options for Windows PCs - Fig.8 — Microsoft Defender Offline Scan Options for Windows PCs – Fig.8

Reference

Run and review the results of a Microsoft Defender Offline scan

We are on WhatsApp. To get the latest step-by-step guides and news updates, Join our Channel. Click here – HTMD WhatsApp.

Author

Krishna. R is a computer enthusiast. She loves writing on Windows 11 and related technologies. She likes to share her knowledge, quick tips, and tricks with Windows 11 or Windows 10 with the community.