Some malware hides from antivirus while Windows is running — rootkits, boot sector infections, or malware that blocks security tools. Microsoft Defender Offline restarts the computer into a minimal trusted environment and scans before the infected Windows can load, so the malware can’t interfere.

When to use it

  • Defender reports threats it can’t remove, or they keep coming back.
  • Security tools are disabled or blocked without explanation.
  • You suspect a rootkit (hidden processes, unexplained network traffic, tampered system files).
  • After a serious infection, as a second check.

Before you start

  • Save your work — the PC restarts and the scan takes about 15 minutes or longer.
  • Update Defender’s definitions first (Windows Security → Virus & threat protection → Protection updates → Check for updates).
  • Make sure you can see the screen during the restart — on a remote server, that means the console, not RDP (see below).

Run it from Windows Security (Windows 10/11)

  1. Open Windows Security → Virus & threat protection.
  2. Click Scan options.
  3. Select Microsoft Defender Offline scan → Scan now.
  4. Confirm. Windows restarts into the scanner, runs the scan, and boots back into Windows.

Run it with PowerShell

Update-MpSignature
Start-MpWDOScan

The computer restarts and runs the offline scan.

Find the results

After Windows starts again:

  • Windows Security → Virus & threat protection → Protection history lists detected and removed threats.
  • Or in PowerShell:
Get-MpThreatDetection | Sort-Object InitialDetectionTime -Descending | Select-Object -First 10
  • Event Viewer: Applications and Services Logs → Microsoft → Windows → Windows Defender → Operational.

On Windows Server and a VPS

  • Start-MpWDOScan is available where Microsoft Defender Antivirus is the active antivirus, including recent Windows Server versions. If a third-party antivirus is installed, Defender may be in passive mode and the offline scan won’t be available — use that vendor’s rescue tools instead.
  • You lose RDP during the scan. Open your provider’s VNC console from the control panel to watch progress, and don’t interrupt the restart.
  • For a production server, schedule the scan in a maintenance window.

If the infection persists

An offline scan removes most threats, but a deeply compromised system may not be trustworthy afterwards:

  1. Change passwords from a clean device — for the server, email, and any accounts used on it.
  2. Check for persistence: new users, scheduled tasks (Task Scheduler), services, startup items (msconfig).
  3. Review security logs — see Windows event logging for auditing.
  4. For servers, the safest fix is often a clean reinstall from the control panel, then restoring data (not programs) from a backup made before the infection.

Prevent re-infection

  • Keep Windows and applications updated.
  • Restrict RDP by IP and use strong passwords — see Windows firewall rules.
  • Don’t browse the web or open email attachments on servers.
  • Keep tested offline backups.

Running a Windows VPS? The VNC console in the control panel lets you follow offline scans and recover even when RDP isn’t available.

  • Windows
  • Security
  • Malware