How to Trigger a Windows Defender Offline Scan in Windows 11 Using PowerShell

Sophisticated malicious software—such as bootkits, kernel-level rootkits, persistent memory hijackers, and credential dumpers—frequently employs advanced evasion techniques while Windows is running. By hooking low-level system APIs and operating system drivers, these threats can evade detection by active antivirus scanners and prevent removal by standard security software.

To eliminate these deeply entrenched threats, Microsoft built Windows Defender Offline (WDO) into Windows 11. Instead of executing within your normal operating system environment, Windows Defender Offline reboots the machine into a dedicated, isolated Windows Recovery Environment (WinRE) sandbox where Windows binaries are dormant, allowing the anti-malware engine to cleanse files without lock contention or rootkit interference.

Understanding How Windows Defender Offline Operates

Windows Defender Offline functions through a specialised pre-OS boot sequence:

• Trusted Execution Sandbox: The system restarts into an isolated micro-kernel environment based on Windows PE / WinRE.
• Static File System Access: Because standard Windows kernel drivers and services are completely inactive, malicious programs cannot intercept disk read operations or cloak their file signatures.
• Targeted Malware Remediation: The offline scanner loads the latest malware definitions cached on the local drive, cleanses the Master Boot Record (MBR), Master File Table (MFT), and Windows system folders, and automatically boots back into Windows 11 upon completion.

Triggering an Offline Scan Using PowerShell

While an offline scan can be scheduled through the graphical Windows Security app, system administrators can trigger an immediate offline remediation sequence directly from an elevated PowerShell console:

1. Right-click the Start button (or press Win + X) and select Terminal (Admin) or PowerShell (Admin).
2. Ensure you have saved all open documents and active work, as triggering the scan prompts an immediate system reboot.
3. Execute the Start-MpWDOScan cmdlet:

   Start-MpWDOScan

4. Press Enter. Windows Defender queues the offline remediation sequence and displays a notification indicating that Windows will restart in approximately one minute.

To reboot immediately without waiting for the timer, execute Restart-Computer -Force immediately after running the command.

Monitoring the Offline Scanning Process

During the reboot sequence:

1. Your PC reboots into the blue Windows Recovery Environment.
2. A dedicated scanning window titled Microsoft Defender Antivirus (Offline Scan) opens automatically.
3. The scanner verifies system files, registry hives, and memory pages. Scans typically take between 10 and 20 minutes depending on your disk size and SSD speed.
4. Once complete, your PC reboots automatically back into normal Windows 11.

Reviewing Scan Results and Detection Logs

Because the scan executes outside the running operating system, scan results are committed to the Windows Defender operational event log upon returning to Windows:

1. Open PowerShell as an Administrator.
2. Query the Microsoft Defender Event Log for recent scan events using Get-WinEvent:

   Get-WinEvent -LogName "Microsoft-Windows-Windows Defender/Operational" | Where-Object { $_.Id -in 1116, 1117, 1001 } | Select-Object -First 10 | Format-Table TimeCreated, Id, Message -Wrap

3. Event ID 1001 confirms the completion of the scan, while Event IDs 1116 and 1117 log any threats detected and successfully quarantined.
4. Alternatively, review findings visually by opening Windows Security > Virus & threat protection > Protection history.