Free tools Windows power users keep installed
One-click scans. No signup required.
Microsoft Defender Offline is a malware scan that starts before the normal Windows environment loads. Because suspected malware is not running inside the usual Windows kernel, it has fewer opportunities to hide or interfere with the scan. On Windows 11 and Windows 10 version 1607 or later, you can start it from Windows Security without a USB drive. The computer restarts, the scan runs in the Windows Recovery Environment, and Windows then starts normally so you can review the result.
Use Offline scan for persistent or hidden-malware concerns, or when a regular in-Windows scan has not removed a suspected infection. It is a second-line remediation step, not a promise that every threat will be detected.
As an Amazon Associate I earn from qualifying purchases.
What an offline scan does
A normal Microsoft Defender Antivirus scan runs while Windows is fully loaded. That is convenient, but a threat that starts with Windows can sometimes conceal files, processes or system changes from a scan running in the same environment. Microsoft describes Defender Offline as a tool that “works outside of Windows, allowing it to catch and clean infections that hide themselves when Windows is running.”
Offline scan instead reboots the computer into the Windows Recovery Environment (WinRE), a trusted environment separate from the normal Windows session. Defender performs its scan there, then hands control back to Windows. You do not browse the desktop while it runs, and the restart is part of the design rather than a sign that something has gone wrong.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
When should you run Microsoft Defender Offline?
Good reasons to choose it
- You suspect persistent malware that returns after a normal scan or after rebooting.
- You are concerned about a rootkit-like threat or another infection that may hide while Windows is running.
- A regular Microsoft Defender scan cannot remove a detected item or keeps reporting the same item.
- You want to scan without Windows being connected to the internet during the scan.
When a normal scan is enough
For routine checking, a Quick scan or Full scan from Windows Security is less disruptive because you can continue using the desktop. Offline scan signs you out and restarts the computer, so it is not the practical choice every time you want a routine check. There is no authoritative percentage showing that Offline scan detects a fixed amount more malware than a normal scan; the useful distinction is the execution environment and the type of persistence it is designed to address.
Before you start
- Save documents and close every program. The restart prompt is expected, and unsaved work can be lost.
- Keep the computer powered for the entire operation. Do not force a shutdown while the recovery environment is scanning.
- Make sure you can sign back in to Windows after the restart so you can inspect Protection history.
Current Windows 10 and Windows 11 installations normally need no external media. The built-in workflow is available on Windows 10 version 1607 or newer and on Windows 11.
Run an offline scan in Windows 11 or supported Windows 10
- Open Windows Security from the Start menu or the taskbar notification area.
- Select Virus & threat protection.
- Under the current-threat or scan area, select Scan options.
- Choose Microsoft Defender Antivirus Offline scan.
- Select Scan now.
- Approve the restart prompt after confirming that your work is saved. Windows signs you out and boots into WinRE.
- Wait for the scan to finish. Windows should load normally again when the offline operation is complete.
Microsoft gives an estimate of about 15 minutes. That is operational guidance, not a guaranteed duration: disk size, hardware speed and what the scan finds can make the process shorter or longer. The display may look different from the normal Windows desktop because the scan is running before the regular session starts.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsRank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Start Defender Offline from PowerShell or WMI
PowerShell
Administrators can launch the same operation with the documented Start-MpWDOScan cmdlet. Open PowerShell with administrative privileges, run:
Start-MpWDOScanThe command schedules Defender Offline and causes the computer to boot into Windows Defender Offline. Save work before issuing it because the restart is still required.
WMI
Microsoft also documents the MSFT_MpWDOScan WMI class as a launch path. This is useful for administration or scripts that already use Windows Management Instrumentation. The class starts the same pre-boot Defender operation; it does not create a different kind of scan.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Find and understand the result
- After Windows loads, open Windows Security.
- Choose Virus & threat protection.
- Select Protection history.
- Look for the entry created by the Offline scan and read its detection and remediation status.
A remediation entry tells you what Defender did with the item, while a lack of a new detection means that this particular scan did not record a threat. Neither result proves that every possible problem is absent. If symptoms continue, record the item name and status shown in Protection history and use that information when deciding whether another scan or technical support is needed.
Recommended Free Tools
Normal scan versus Offline scan
| Aspect | Normal Windows scan | Microsoft Defender Offline scan |
|---|---|---|
| Execution environment | Runs inside the normal Windows session and kernel. | Runs after reboot in the Windows Recovery Environment, before the normal session loads. |
| Desktop availability | You can generally continue working, although heavy scans may use system resources. | The computer is signed out and unavailable until the pre-boot scan completes and Windows starts again. |
| Best use | Routine checks and ordinary malware investigations. | Suspected persistent, hidden or rootkit-like malware, or a threat a normal scan cannot remove. |
| External media on current systems | None required. | None required on Windows 10 version 1607 or newer and Windows 11. |
| Where to check findings | Windows Security notifications and Protection history. | Protection history after Windows loads again. |
The offline option changes when the scan runs, not the basic purpose of Defender: it still examines the computer for malicious software and records any action in Windows Security.
Windows 7 SP1 and Windows 8.1: use bootable media
The integrated Windows Security workflow described above is for Windows 10 version 1607 or newer and Windows 11. Microsoft’s older procedures for Windows 7 SP1 and Windows 8.1 require bootable Defender Offline media on a CD, DVD or USB flash drive.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Prepare the media safely
- Use a blank or backed-up CD, DVD or USB flash drive with at least 250 MB of free space.
- Create the bootable media on a computer believed to be clean. Malware on the creator computer could interfere with the creation process.
- Back up anything important on the USB drive first. Creating the media reformats the drive and erases its existing contents.
Boot and scan
- Use Microsoft’s Defender Offline media-creation procedure for the relevant legacy Windows edition.
- Insert the resulting CD, DVD or USB drive into the Windows 7 SP1 or Windows 8.1 computer.
- Restart the computer and boot from that media, using the computer’s boot-device selector if it does not start from the drive automatically.
- Allow Defender Offline to complete its scan, then remove the media and start Windows normally.
- Review the available Defender results after Windows starts. The exact result screen can differ from the current Windows Security Protection history interface.
Do not use this legacy-media procedure as a routine requirement on a supported Windows 10 or Windows 11 installation; those versions normally launch Offline scan from Windows Security without a USB drive.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot common problems
The Offline scan option is missing
Check the Windows version first. The built-in option is documented for Windows 10 version 1607 or later and Windows 11. Earlier Windows releases use the bootable-media method instead. If the computer is on a supported version but the menu still lacks the option, try the documented PowerShell command from an elevated session.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The computer did not restart
Confirm that you accepted the restart prompt and that the command was run with administrative privileges. Save work, close Windows Security, reopen it and try the menu path again. A PowerShell launch with Start-MpWDOScan is an alternative documented path.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
The scan appears to stop or takes longer than 15 minutes
Fifteen minutes is Microsoft’s estimate, not a time limit. Leave the computer powered on and allow the operation to finish; hardware, storage capacity and findings affect the duration. Forcing a shutdown can interrupt the scan and leave you without a complete result.
You cannot find a result afterward
Wait until Windows has fully loaded, then open Windows Security, select Virus & threat protection and open Protection history. If there is no new entry, check that the Offline scan actually ran rather than only scheduling a restart, and repeat the launch from Windows Security or PowerShell.
You need Offline scan on a legacy computer
Windows 7 SP1 and Windows 8.1 do not use the current in-product workflow. Create fresh bootable media on a trusted clean computer, remember that USB creation reformats the drive, and verify that the drive has at least 250 MB free before starting.
Practical decisions before choosing Offline scan
- Choose it now: the same suspicious behavior returns after a normal scan, or the suspected malware appears persistent or hidden.
- Use a normal scan first: you are performing a routine check and cannot afford a restart at the moment.
- Use legacy media: the computer runs Windows 7 SP1 or Windows 8.1.
- Plan for interruption: save all work because the machine will restart and the desktop will be unavailable during the scan.
Microsoft Defender Offline is therefore a targeted pre-boot check, not a special USB-only feature on modern Windows. Its value comes from scanning before the usual Windows environment can load malware that might hide or interfere.
Quick Recap
If you prefer an optional shortcut after trying the manual steps, Outbyte PC Repair can address more than 100 common Windows issues where possible, clean temporary and cache files, check selected Windows vulnerabilities and provide tools such as real-time boost, file shredding and crash logging. It complements antivirus software and does not replace it; results vary and no tool repairs every crash. It runs on Windows 11, 10, 8 and 7 with a free trial by category of at least two days, followed by a subscription.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
