Windows 10: Windows Defender Offline Scan in Windows 10

How to: Windows Defender Offline Scan in Windows 10

How to Perform a Windows Defender Offline Scan in Windows 10


Windows Defender Offline is now a built-in feature starting in Windows 10 build 14271.

Windows Defender Offline is an antimalware scanning tool that lets you boot and run a scan from a trusted environment. The scan runs from outside the normal Windows kernel so it can target malware that attempts to bypass the Windows shell, such as viruses and rootkits that infect or overwrite the master boot record (MBR).

You can use Windows Defender Offline if you suspect a malware infection, or you want to confirm a thorough clean of the endpoint after a malware outbreak.

In Windows 10, Windows Defender Offline can be run with one click directly from the Windows Defender client. In previous versions of Windows, a user had to install Windows Defender Offline to bootable media, restart the endpoint, and load the bootable media.

This tutorial will show you how to manually run an offline scan of your PC with Windows Defender Offline in Windows 10.

You must be signed in as an administrator to be able to scan offline with Windows Defender Offline.

Windows Defender Offline Scan log files are stored as a MPLog-YYYYMMDD-HHMMSS.log file located in the C:\Windows\Microsoft Antimalware\Support folder.

You will notice D:\ProgramData\Microsoft\Windows Defender\Offline Scanner towards the top in the opened log file.







Windows Defender event logs are saved to the file below. You can open it to view the logs in Event Viewer.

%windir%\System32\winevt\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx









Contents

• Option One: To Run a Windows Defender Offline Scan from PowerShell
• Option Two: To Run a Windows Defender Offline Scan from Command Prompt
• Option Three: To Run a Windows Defender Offline Scan from Windows Defender Security Center

OPTION ONE [/i] To Run a Windows Defender Offline Scan from PowerShell
For more usage options for the Start-MpWDOScan command, see: Start-MpWDOScan


1 Open an elevated PowerShell.

2 Copy and paste the Start-MpWDOScan command into the elevated PowerShell, and press Enter.

3 Go to step 6 in OPTION THREE below.





OPTION TWO [/i] To Run a Windows Defender Offline Scan from Command Prompt
For more usage options for the Start-MpWDOScan command, see: Start-MpWDOScan


1 Open an elevated command prompt.

2 Copy and paste the PowerShell Start-MpWDOScan command into the elevated command prompt, and press Enter.

3 Go to step 6 in OPTION THREE below.





OPTION THREE [/i] To Run a Windows Defender Offline Scan from Windows Defender Security Center
1 Open Windows Security, and click/tap on the Virus & thread protection icon. (see screenshot below)



2 Click/tap on the Scan options link under the Current threats section. (see screenshot below)



3 Select (dot) Windows Defender Offline scan, and click/tap on the Scan now button. (see screenshot below)



4 Click/tap on Scan. (see screenshot below)



5 If prompted by UAC, click/tap on Yes. (see screenshot below)



6 You will now see a message that You're about to be signed out to restart your PC in less than a minute to run the scan offline. (see screenshot below)



7 When your PC restarts, you will see Windows Defender Offline loading. (see screenshot below)

It may take a while before this is finished and continues to the next step.




8 Windows Defender will now automatically perform a quick scan of your PC in the recovery environment. (see screenshot below)

Your PC will automatically restart when the scan has finished.




9 When the offline scan has finished, your PC will automatically restart to Windows 10.

That's it,
Shawn


Related Tutorials

• How to Create a Windows Defender Antivirus Shortcut in Windows 10
• How to Add or Remove Windows Defender context menu in Windows 10
• How to Create a Windows Defender Offline Scan shortcut in Windows 10
• How to Manually Scan Files, Folders, and Drives with Windows Defender in Windows 10
• How to Schedule a Scan in Windows Defender Antivirus in Windows 10

:)

 

WDO Windows Defender Offline

In Windows 10,
Windows Defender Offline is built into the operating system so it can be run automatically or you can manually ask to perform an offline scan with one click directly from the Windows Defender client.

When Windows Defender identifies malware which it cannot remove, it will recommend that Windows Defender Offline be run and on the next reboot, Windows Defender Offline will automatically scan and remove the malware, then reboot into Windows 10. This removes
the need to interact with the Windows Defender Offline product manually but that option is available when you want to run an offline scan at any time. When Windows Defender Offline runs automatically it performs a Quick Scan by default which typically takes
about 15 minutes to run and then your computer will restart normally.

 

Windows 10 Defender Full Scan consistently fails and stops responding. Have to power off system to recover. Can I download a new version of Defender?

There's no way to download a new version, but you could try an offline scan as shown here:

Windows 10:
Windows Defender Offline Scan in Windows

 

Before offline scan in preperation








After offline scan

 

Final results

 

I found the Offline Scanner folder: C:\ProgramData\Microsoft\Windows Defender\Offline Scanner
Here is the EULA:

 

Also MpSwpHelp:

 

It appears that the C:\ProgramData\Microsoft\Windows Defender\Offline Scanner folder isn't available by default until you have done an offline scan with Windows Defender Offline first.

 

I was trying to see if one of .exe(both as normal and as admin run) would start the offline scan, so you could make a shortcut, but... nope.

So you think it(like many Windows features) unpacks and installs itself when run for the first time? Makes sense, that would save disk space, if never needed, and resources.

 

That seems to be the case for this to not be available until used.

There doesn't appear to be an easy way to create a quick shortcut to directly run this so far. *Sad

 

Nope. I have used my MFT scanner(just installed it in the VM) and it cannot find a link to the button, just to the settings. Also it's not in the system32 part of Defender or in Program Files or Program Files(x86) or in the Uni Apps shortcuts list. Maybe if I set File Explorer to Unhide protected OS files?

 

The tutorial has been updated to add OPTION ONE and OPTION TWO to be able to run a Windows Defender Offline scan using PowerShell and command prompt. *Smile

 

Now everyone on 1511 and upwards can offline scan now*Thumbs

 

So, I've tried this out on a fully patched 1511 (10586) build of enterprise, and neither of the commandlines (powershell called and cmd called) and neither seem to do anything, the command runs without error, but the scan does not begin. I do have the folder in programdata. Anyone have any thoughts on that?

 

Hi @cubspsycho85 welcome to Ten Forums*Smile

I was having that problem on one of my PCs(laptop) and tried many a fix.
Read this thread for the background: https://www.tenforums.com/tutorials/4...dows-10-a.html


The only thing that worked was a repair install.
Repair Install Windows 10 with an In-place Upgrade