How to Run Microsoft Defender Offline Scan in Windows 11 to Remove Deep Malware

Sophisticated malware, boot-sector viruses, and kernel-level rootkits are engineered to conceal their execution from standard antivirus scanners running inside an active Windows operating system. Once loaded into memory, advanced threats can hook system calls and block security tools from detecting or deleting malicious binaries. Running a Microsoft Defender Offline scan Windows 11 solves this vulnerability by restarting your PC into an isolated Windows Preinstallation Environment (WinPE) where malware cannot run or defend itself.

What Is Microsoft Defender Offline Scan?

Microsoft Defender Offline is a specialized anti-malware scanning tool built directly into Windows 11. Instead of executing within your standard user session, initiating an offline scan triggers an immediate system restart. Your PC boots into a secure, temporary pre-execution environment loaded with the latest virus definition signatures. Because the core Windows operating system, third-party services, and startup applications remain dormant on the hard drive, offline Defender can safely inspect locked system files, master boot records (MBR), and registry hives to eliminate deeply embedded rootkits.

When Should You Use an Offline Scan?

Running an offline scan is strongly recommended in the following scenarios:

• Microsoft Defender Antivirus detects a persistent threat (such as a rootkit, trojan dropper, or ransomware precursor) and prompts you that offline remediation is required.
• Your computer exhibits symptoms of compromise (such as unprovoked browser redirects, sudden CPU spikes, or disabled security settings), but standard Quick and Full Scans report zero detections.
• Antivirus definition updates or system security services are repeatedly failing to start due to suspected tampering.

How to Run Microsoft Defender Offline Scan in Windows 11 Settings

Initiating the scan requires just a few clicks through the Windows Security dashboard:

1. Click the Start button and type Windows Security, then press Enter.
2. In the security dashboard, select Virus & threat protection.
3. Under the Current threats section, click Scan options (located directly beneath the Quick scan button).
4. Scroll down and select the radio button for Microsoft Defender Antivirus (offline scan).
5. Click the Scan now button at the bottom of the page.
6. A prompt appears warning you to save your work because your PC will restart immediately.
7. Click Scan and confirm the User Account Control (UAC) prompt.

What Happens During the Offline Scan Process?

Once you confirm the scan:

1. Windows saves pending memory states and immediately reboots your computer.
2. Instead of loading your usual desktop login screen, a black screen with the blue Windows logo appears, followed by a blue progress window labelled Microsoft Defender Antivirus.
3. The scan typically takes between 15 and 25 minutes depending on the speed of your storage drive and the number of system files.
4. Defender scans boot partitions, driver directories, system binaries, and system memory. If any threat is discovered, Defender quarantines or purges it automatically.
5. When the scan finishes, your PC restarts automatically and boots back into normal Windows 11.

How to Check Offline Scan Detection Results

Because the offline environment does not display an interactive log after rebooting, you can review the scan results in your standard security history:

1. Open Windows Security.
2. Click Virus & threat protection.
3. Click Protection history.
4. Any threats detected and remediated by the offline engine will be documented here with detailed severity levels, affected file paths, and quarantine timestamps.