A Microsoft Defender Offline scan restarts your PC and scans from outside normal Windows, so stubborn malware (including some rootkits) has a harder time hiding. Microsoft documents this as an offline scan you start from Windows Security; it typically takes about 15 minutes and restarts the PC when finished. This guide is about running that built-in offline scan, not whether Defender is “enough” day to day, a full 9-step clean, or Malwarebytes + Defender stacking. You do not need to buy a paid suite to run it.

1. When an Offline scan helps

From Microsoft Learn / Windows Security guidance:

  1. You suspect malware that a normal scan isn’t catching.
  2. Windows Security prompts you to run an offline scan.
  3. You want a thorough check after a known bad download or infection cleanup.
  4. You’re okay with a restart (save work first).

2. How to run Microsoft Defender Offline scan (Windows 10/11)

  1. Save open files and close apps — The scan restarts your PC.
  2. Open Windows Security (search for it from Start).
  3. Go to Virus & threat protection.
  4. Under Current threats, open Scan options.
  5. Select Microsoft Defender Antivirus (Offline scan).
  6. Choose Scan now and confirm.
  7. Let the PC restart into the recovery/offline environment and finish the scan (~15 minutes per Microsoft).
  8. After Windows loads again, open Windows Security → Protection history to review results.

3. If the scan finds threats

  1. Note what Protection history lists (quarantined / removed / allowed).
  2. If the PC still misbehaves, follow a structured clean: 9 steps to clean a virus-infected Windows PC.
  3. Back up important files from a known-good state when possible: how to back up files from a virus-infected computer.
  4. Keep Windows Update current; stuck updates aren’t always malware — see Windows Update stuck or virus.
  5. If another paid AV is fighting Defender, uninstall the old suite cleanly before relying on Defender: uninstall McAfee or Avast and use Windows Defender.

4. Household habits that cut risk (no software purchase required)

  1. Run a quick scan after any “I clicked a weird attachment” moment — escalate to Offline scan if symptoms remain.
  2. Keep real-time protection on in Windows Security.
  3. Don’t ignore Windows Security notifications about offline scans.
  4. Use unique passwords + MFA so a cleaned PC isn’t re-compromised via reused logins.
  5. Teach the household: Offline scan is free and built in — scareware popups selling “urgent PC repair” are not the same thing.

FAQ

How do I run a Microsoft Defender Offline scan?

Windows Security → Virus & threat protection → Scan options → Microsoft Defender Antivirus (Offline scan) → Scan now. Save work first; the PC restarts.

How long does it take?

Microsoft guidance commonly cites about 15 minutes for the offline scan, then an automatic restart back into Windows.

Will it delete my files?

It is a malware scan from a trusted environment, not a factory reset. Still, save work before the reboot and review Protection history afterward.

Do I need to buy Norton or Bitdefender to run this?

No. Offline scan is part of Microsoft Defender / Windows Security on supported Windows 10/11 PCs.

Is Microsoft Defender enough after an Offline scan?

Often yes for careful households — see Is Microsoft Defender enough?. Paid suites are optional preference, not a requirement of this scan.

Running Defender Offline does not require a paid product. Microsoft Defender is a valid buy-nothing choice for many Windows households. If the household later wants multi-device paid protection, use only these on-site paid links: TotalAV (paid link), Norton (paid link), Bitdefender (paid link), McAfee (paid link), Avast (paid link).