When your computer is at risk, every tool counts. Windows Defender Offline Scan is a powerful feature in Windows 10 and Windows 11. It scans your PC for malware before Windows loads, helping find threats that hide from regular scans. But sometimes, this lifesaver refuses to work. Maybe it doesn’t start, fails to complete, or restarts your PC without scanning. If you’re facing these problems, you’re not alone—and fixing them is possible.
This guide takes you through every reason why Windows Defender Offline Scan might not work and gives you clear, practical solutions. You’ll learn what causes these issues, how to fix them step by step, and what to do if nothing helps.
Whether you’re a home user or IT support, this article gives you the answers you need in plain English.
What Is Windows Defender Offline Scan?
Windows Defender Offline Scan is a security tool built into Windows. Unlike standard scans, it runs before your system loads, making it harder for viruses and malware to hide. This type of scan is especially useful for finding rootkits and advanced threats that normal scans may miss.
To use it, you go to Windows Security > Virus & Threat Protection > Scan Options, and choose “Windows Defender Offline scan. ” Your PC restarts, then scans for malware before Windows starts. If malware is found, it tries to remove it automatically.
Why is this scan so important? Some threats can hide deep inside your system. They start before Windows, or even block security software. Running an offline scan gives Windows Defender a better chance to find and remove these hidden threats.
Why Windows Defender Offline Scan Fails
When Windows Defender Scan Offline doesn’t work, it’s frustrating and risky. Here are the most common reasons:
- Corrupt Windows System Files: Damaged files can stop Defender from launching offline mode.
- Malware Tampering: Sophisticated viruses can block security tools.
- Outdated Windows or Defender: Old versions may have bugs or compatibility issues.
- Third-party Antivirus Conflicts: Other security software can interfere with Defender’s offline scan.
- Boot Configuration Problems: Issues with boot files may stop the scan from starting.
- Fast Startup Enabled: This feature can block the correct restart for offline scans.
- UEFI/Secure Boot Settings: Modern PCs use UEFI with Secure Boot, which sometimes blocks Defender’s offline scan.
- BitLocker Encryption: If your drive is encrypted, the scan may not access all data.
- User Account Control (UAC) Settings: Incorrect UAC levels can block required permissions.
- Hardware Issues: Failing hard drives or memory errors can prevent a successful scan.
Knowing the cause is the first step. The next sections will show you how to fix each problem.
Step-by-step Fixes For Windows Defender Offline Scan Issues
Fixing Windows Defender Scan Offline Not Working can take a bit of detective work. Here’s how to troubleshoot and solve the problem, step by step.
1. Update Windows And Defender
Outdated software can cause unexpected errors. Start by making sure Windows and Defender are both updated.
- Go to Settings > Update & Security > Windows Update.
- Click Check for updates.
- Install all available updates, including security updates and cumulative patches.
- For Defender, open Windows Security > Virus & Threat Protection > Protection Updates.
- Click Check for updates.
Tip: Even small updates can fix big problems with security tools.
2. Run System File Checker (sfc) And Dism
Corrupt or missing system files stop Defender’s offline scan from working.
- Open Command Prompt as administrator (search “cmd”, right-click, choose “Run as administrator”).
- Type: `sfc /scannow` and press Enter.
- Wait for the scan to complete (it may take 10–20 minutes).
- If issues are found and fixed, restart your PC.
- Next, run DISM to repair deeper problems. Enter:
- `DISM /Online /Cleanup-Image /RestoreHealth`
This process repairs Windows image files. Reboot after it’s done.
3. Check For Third-party Antivirus Conflicts
Running other antivirus software together with Defender can cause conflicts, especially during offline scans.
- Open Control Panel > Programs and Features.
- Look for any antivirus programs (Norton, McAfee, Avast, etc. ).
- If you have another antivirus, either disable its real-time protection or uninstall it.
- Restart your PC and try the offline scan again.
Non-obvious insight: Some antivirus programs leave behind drivers or services even after uninstalling. Use the official removal tool from the antivirus company to clean up fully.
4. Disable Fast Startup
Fast Startup saves time during boot, but can interfere with security scans that need a full restart.
- Go to Control Panel > Power Options > Choose what the power buttons do.
- Click Change settings that are currently unavailable.
- Uncheck Turn on fast startup (recommended).
- Save changes and restart your PC.
5. Check Uefi And Secure Boot Settings
On modern PCs, UEFI replaces the old BIOS. Sometimes, Secure Boot blocks Defender’s offline scan.
- Restart your PC and enter the UEFI/BIOS setup (often by pressing F2, Delete, or Esc at boot).
- Look for Secure Boot settings.
- Temporarily disable Secure Boot, save, and exit.
Important: Turn Secure Boot back on after running the scan, to keep your PC safe.
6. Check Bitlocker And Drive Encryption
If your drive is encrypted with BitLocker, Defender may not be able to scan everything.
- Go to Control Panel > BitLocker Drive Encryption.
- If BitLocker is on, suspend it before running the offline scan.
Note: Remember to resume BitLocker after the scan.
7. Repair Boot Configuration Data (bcd)
Boot issues can block Defender’s offline scan from starting correctly.
- Boot from a Windows installation USB/DVD.
- Choose Repair your computer > Troubleshoot > Advanced options > Command Prompt.
- Run:
- `bootrec /fixmbr`
- `bootrec /fixboot`
- `bootrec /scanos`
- `bootrec /rebuildbcd`
Restart and try the scan again.
8. Run Memory And Hard Drive Diagnostics
Hardware problems, like bad RAM or failing drives, can cause scan failures.
- Search for Windows Memory Diagnostic and run it.
- For the hard drive, open Command Prompt as administrator and type:
- `chkdsk C: /f /r`
- Allow the scan to complete and fix any problems found.
9. Adjust User Account Control (uac) Settings
Low UAC levels may block Defender’s permissions.
- Go to Control Panel > User Accounts > Change User Account Control settings.
- Set the slider to Default or Always notify.
- Click OK and restart.
10. Check Windows Defender Service Status
If the Windows Defender Antivirus Service is not running, the offline scan won’t start.
- Open Services (type “services.msc” in Start Menu).
- Find Windows Defender Antivirus Service.
- Make sure it’s set to Automatic and is running.
- If stopped, right-click and select Start.
11. Try Running The Offline Scan From Command Line
Sometimes, running the scan from command prompt works even when the menu option fails.
- Open Command Prompt as administrator.
- Enter:
- `”%ProgramFiles%Windows DefenderMpCmdRun.exe” -Scan -ScanType 2`
- This command starts an offline scan directly.
12. Check For Malware That Blocks Defender
Sophisticated malware may block Defender offline scans.
- Download Microsoft Safety Scanner from the official Microsoft website.
- Run a full scan.
- If malware is found, remove it and try the offline scan again.
13. Create A Windows Defender Offline Usb
If the built-in scan won’t start, use a USB stick.
- Download Windows Defender Offline tool from Microsoft.
- Insert a blank USB drive (at least 500MB).
- Follow instructions to create a bootable Defender USB.
- Boot from USB and run the offline scan.
Pro tip: This method works even if Windows won’t start or malware is blocking Defender.
14. Review Event Viewer Logs
Event Viewer helps you find hidden errors during offline scan attempts.
- Search for Event Viewer and open it.
- Go to Windows Logs > Application and System.
- Look for errors related to Windows Defender, MpCmdRun, or Offline Scan.
- Note any error codes or messages.
Search for these errors online or in Microsoft’s documentation for more details.
15. Restore Windows To A Previous State
If nothing works, system restore may help.
- Go to Settings > Update & Security > Recovery.
- Click Open System Restore.
- Choose a restore point before the problem started.
- Complete the process and try the offline scan again.
16. Reinstall Windows Defender
On some systems, Defender can be reset or reinstalled.
- Open PowerShell as administrator.
- Type:
- `Uninstall-WindowsFeature -Name Windows-Defender`
- Then reinstall with: `Install-WindowsFeature -Name Windows-Defender`
- Restart your PC.
Note: This is advanced and usually needed only on Windows Server editions.
Comparing Troubleshooting Methods
To help you decide which fixes to try first, here’s a comparison of the most common troubleshooting steps:
| Method | Difficulty | Time Required | Success Rate |
|---|---|---|---|
| Update Windows/Defender | Easy | 10-20 min | High |
| Run SFC/DISM | Medium | 30-40 min | Medium |
| Remove Antivirus Conflicts | Easy | 10-15 min | High |
| Repair Boot Data | Advanced | 20-30 min | Medium |
| Create Defender USB | Medium | 20-25 min | High |
As you can see, updating Windows/Defender and removing antivirus conflicts are both easy and often fix the problem. Creating a bootable USB is effective if other steps fail.
Credit: www.youtube.com
Common Error Messages And What They Mean
If Windows Defender Offline Scan fails, you might see error codes or messages. Understanding them can help you fix the issue faster.
- 0x80070005 – Access Denied: Usually a permissions problem. Try running as administrator or adjusting UAC.
- 0x8007139f – The group or resource is not in the correct state: Often caused by conflicting security software.
- 0x800704ec – This program is blocked by group policy: Defender is disabled by policy or another antivirus.
- “Windows Defender Offline Scan could not be started”: May indicate corrupt files or a problem with Secure Boot.
- No error, but PC restarts without scanning: Fast Startup or boot configuration issues.
Tip: Always check the Event Viewer for more details.
Advanced Solutions For Persistent Problems
If basic steps don’t help, try these advanced fixes.
Editing The Windows Registry
Be careful: the Registry is powerful but risky.
- Press Win+R, type `regedit`, and press Enter.
- Navigate to:
- `HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindows Defender`
- Delete the DisableAntiSpyware or DisableAntiVirus entries if they exist.
- Restart your PC.
Warning: Only change the registry if you are confident. Back up your registry first.
Resetting Windows Security App
Sometimes, the Windows Security app itself gets corrupted.
- Open Settings > Apps > Apps & features.
- Find Windows Security.
- Click Advanced options > Reset.
This will reset the app without losing your data.
Using Group Policy Editor
If Defender is disabled by policy:
- Press Win+R, type `gpedit.msc`, and press Enter.
- Go to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus.
- Set Turn off Microsoft Defender Antivirus to Disabled or Not Configured.
Credit: learn.microsoft.com
A Visual Guide: Offline Scan Process
Understanding the steps can help you spot where things go wrong.
| Step | Action | What to Expect |
|---|---|---|
| 1 | Select Windows Defender Offline Scan in Windows Security | Prompt to save work, then PC restarts |
| 2 | PC reboots into Defender’s offline environment | Blue or black screen with Defender logo appears |
| 3 | Scan runs without Windows loading | Progress bar shows scan status |
| 4 | PC restarts again and loads Windows | Scan results show in Windows Security app |
If you don’t see these steps, something is blocking the scan.
What To Do If Nothing Works
If all else fails, consider these last-resort options:
- Backup your data to an external drive or cloud storage.
- Perform a clean installation of Windows. This erases everything, so only do it if you have backups.
- Use a third-party bootable antivirus, such as Kaspersky Rescue Disk or ESET SysRescue Live. These can remove threats that block Defender.
Non-obvious insight: Sometimes, stubborn malware disables Windows updates and Defender together. In these cases, you may need to clean the PC with a bootable tool before Windows Defender will work again.
Preventing Future Windows Defender Scan Problems
Once you’ve fixed the problem, keep your system healthy to avoid repeat issues.
- Keep Windows and Defender updated at all times.
- Avoid running two antivirus programs together.
- Regularly run SFC and DISM to fix system files.
- Check for malware with a second opinion scanner every few months.
- Back up important data in case you ever need to reset your PC.
Windows Defender Offline Scan Vs Other Security Tools
How does Windows Defender Offline Scan compare to other security options? Here’s a quick look:
| Feature | Windows Defender Offline | Third-party Antivirus (bootable) | Regular Defender Scan |
|---|---|---|---|
| Scans before Windows loads | Yes | Yes | No |
| Removes rootkits | Yes | Yes | Sometimes |
| Needs extra download/USB | No (unless built-in fails) | Yes | No |
| Integrated with Windows | Yes | No | Yes |
| Free to use | Yes | Varies | Yes |
Windows Defender Offline Scan is a strong first choice, but third-party tools are useful if Defender is blocked.
Credit: learn.microsoft.com
Frequently Asked Questions
What Is The Difference Between Windows Defender Offline Scan And A Regular Scan?
Windows Defender Offline Scan runs before Windows loads, so it can detect and remove threats that hide during normal operation. A regular scan runs inside Windows, making it less effective against rootkits and advanced malware.
Can Windows Defender Offline Scan Remove All Types Of Malware?
It is very effective against rootkits, trojans, and persistent threats, but no tool is perfect. Some advanced malware may still survive. If problems continue, try a third-party bootable antivirus.
Why Does My Computer Restart But Not Scan During Windows Defender Offline Scan?
The most common reasons are Fast Startup enabled, boot configuration problems, or interference from other security software. Disabling Fast Startup and checking for antivirus conflicts often solves this.
Is It Safe To Turn Off Secure Boot For Defender Offline Scan?
It is usually safe if you turn it back on after scanning. Secure Boot helps protect your system, so don’t leave it off permanently.
Where Can I Find Scan Results After Running Windows Defender Offline Scan?
After you log back in, open Windows Security > Virus & threat protection > Protection history. This section shows what was found and what actions were taken.
Conclusion
If you follow these steps, you should be able to fix most Windows Defender Scan Offline Not Working problems. The process can take time, but it’s worth it to keep your PC safe. For more details on Windows Defender and security best practices, check out the official Microsoft Windows Security Help page. Your digital security depends on regular scans—don’t let a blocked tool put you at risk.