Microsoft Defender Offline scan review

Every Windows 10 and 11 PC already has a boot-time cleanup tool, and many people never find it. In the Windows Security app, the scan options include Microsoft Defender Antivirus (offline scan). Microsoft explains that it restarts the device and scans without loading Windows, so persistent malware has a harder time hiding or defending itself. It uses the latest definitions, can run without an internet connection, and performs a quick scan of the PC in the Windows Recovery Environment before restarting automatically. Results then appear in the Windows Security app's protection history. That makes it a sensible step after a regular scanner keeps finding the same threat again. The limits are worth knowing. Microsoft describes the offline pass as a quick scan, it will restart the PC mid-task, and Microsoft Defender Antivirus switches itself off if you install a compatible third-party antivirus. It is a free extra layer, not a full substitute for a dedicated scanner.

Who it is for

Windows 10 and 11 users facing persistent malware that hides or fights back while Windows runs.

Price

Included with the Windows Security app, no separate purchase.

Even though Windows Security is turned on and scans your device automatically, you can perform an additional scan whenever you want.
Quoted from the vendor pricing page on November 10, 2026.

Key features

• Offline scan runs after a restart without loading Windows
• Uses the latest Microsoft Defender definitions
• Runs in the Windows Recovery Environment
• Quick, full and custom scans in the same Windows Security page
• Quarantine history and allowed threats list in Windows Security

Strengths and weaknesses

• Strength: Already on Windows PCs, nothing to download
• Strength: Harder for persistent malware to hide during the scan
• Strength: Can scan without an internet connection
• Weakness: Microsoft says the offline option performs a quick scan
• Weakness: Restarts the PC, so open work must be saved first
• Weakness: Turns off if another antivirus is installed and active

Key facts

• Where to find it: Windows Security, Virus and threat protection, Scan options
• Runs in: Windows Recovery Environment
• Internet needed: No
• Price: Included with Windows

Where it ranks

Microsoft Defender Offline scan is No. 5 in our Best Malware Removal Tools verdict.