An offline malware scan interrupts the running Windows session. Prepare for that interruption before choosing Scan now, especially if the PC contains open work or belongs to an organisation.

This procedure is for x64 Windows 11. Microsoft excludes Windows on Arm from Defender Offline support. Defender must be the primary antivirus, with current updates, and the user needs local administrator privileges. On a managed computer, have IT confirm those conditions.

Check recovery and encryption before restarting

Windows Recovery Environment must be enabled. An administrator can check with reagentc /info. If it reports Disabled, stop and resolve that prerequisite with appropriate support; Microsoft warns that the offline scan may otherwise do nothing without displaying an error.

Have access to your recovery information privately. If the system drive uses BitLocker, Microsoft instructs you to suspend its protection before the scan. In the BitLocker Drive Encryption Control Panel, select the operating-system drive and Suspend protection. If those controls are unavailable or managed, obtain assistance before proceeding.

Choose a time when you can stay with the computer. Save documents, finish transfers and close programs. Record the original symptom and the time you are starting, so the later result has context.

Start the scan and inspect the return

In Windows Security, open Virus & threat protection, Scan options, and select Microsoft Defender Offline scan. Choose Scan now and confirm the displayed prompts. The PC restarts into the offline scan and returns to Windows afterwards.

Review Protection history for the scan’s findings. Also check BitLocker’s status; use Resume protection on the operating-system drive if it remains suspended. Confirm that it is protected again.

Record whether you actually observed the offline scan, any reported action, and whether the original symptom remains. A reboot alone does not establish that a scan ran, and an empty alert list is not a complete explanation of ongoing abnormal behaviour.

If the scan never starts or the computer cannot return normally, preserve the exact message and seek help. Avoid repeated recovery changes made only to force the scan to run.

Sources: Microsoft Defender Offline requirements and scan; Microsoft BitLocker operations.