How to Clear the Windows Defender Offline Scan Cache using PowerShell

The Need for Offline Scanning

Modern malware, particularly rootkits and bootkits, is incredibly sophisticated. Once it infects a Windows machine, it often embeds itself so deeply into the operating system kernel that it can hide from standard antivirus software while Windows is running. If Windows Defender detects a deeply entrenched threat but fails to remove it, the standard operating procedure is to trigger a Windows Defender Offline Scan.

An offline scan reboots the computer into a minimal, secure environment (Windows RE) before the primary operating system loads, allowing Defender to surgically extract the malware while it is dormant. However, the system relies on a local cache to store the scan results and operational logs. If this cache becomes corrupted, your computer might become trapped in an infinite boot loop, continually attempting and failing to execute the offline scan upon every restart.

To break this loop and restore normal boot operations, you must forcefully clear the Windows Defender Offline Scan Cache.

Using the Command Line

Because the offline scan environment modifies the system boot record, you cannot easily clear its cache using the graphical Windows interface. You must use a specialized command-line utility designed for managing Windows Defender.

You must open PowerShell or Command Prompt with elevated Administrator privileges.

Executing the MpCmdRun Utility

The core command-line tool for Defender is called MpCmdRun.exe. It is located deep within the Program Files directory.

First, navigate to the Defender directory:

cd "%ProgramFiles%\Windows Defender"

Once inside the directory, you will execute the command to purge the offline scan cache. This is achieved using the -RemoveDefinitions flag, coupled with the specific -All modifier which forces a complete purge of both the signature definitions and the offline boot staging data.

MpCmdRun.exe -RemoveDefinitions -All

Understanding the Output

The command will take a few moments to execute as it halts the Defender engine and deletes the massive cache files. You will see output resembling the following:

Service Control: Stop Service (WinDefend)
Removing definitions...
Done!
Service Control: Start Service (WinDefend)

By forcing the deletion of all definitions, you have successfully destroyed the corrupted offline scan cache. The next time you reboot the computer, the bootloader will no longer see the instruction to boot into the offline environment, and Windows will load normally.

Forcing a Fresh Update

Because you used the -All flag, you have also deleted your standard virus definitions. Your computer is currently unprotected. You must immediately force Windows Defender to download a fresh, uncorrupted set of signatures from Microsoft’s servers.

Run the following command while still in the Windows Defender directory:

MpCmdRun.exe -SignatureUpdate

Once the download completes, your system is fully secure, and the infinite boot loop is permanently resolved.