Windows Defender Offline, by Microsoft, is a specialized malware removal tool for persistent threats that can interfere with regular antivirus scans. It restarts the PC into a trusted recovery environment before checking for suspicious files and boot-level malware outside the normal Windows session. The tool suits users, technicians, and administrators who need an extra cleanup step after a serious security alert or suspected infection.

When Windows steps out of the way

The scan runs outside the standard Windows environment, giving persistent malware less opportunity to hide, block, or disrupt the security process. This setup lets Microsoft Defender Offline inspect files and system areas that remain active or protected during a normal session. That deeper access is a key advantage for checking rootkits and malware linked to the master boot record after standard protection raises concerns.

Built for stubborn threats, not daily scans

Windows Defender Offline focuses on serious infections that can survive or interfere with normal antivirus activity. It works as an escalation tool when a regular scan finds a persistent threat or when a PC shows signs of deeper compromise. This focused role is useful for cleanup, although it is not a replacement for real-time protection, scheduled scans, or keeping Microsoft Defender Antivirus updated.

A reboot is part of the deal

Running an offline scan requires administrator access and restarts the PC before the scan begins. Microsoft estimates that the process takes about 15 minutes, although timing varies with the device and storage setup. Windows Recovery Environment must also be enabled. BitLocker-protected devices need extra attention because users can need to suspend BitLocker first or enter a recovery key after the restart.

Built into Windows, with an older rescue route

On current Windows systems, the scan is available through Windows Security, making it easier to start without installing a separate security program. Scan results appear in Protection history after the device returns to normal operation. Older Windows 7 SP1 and Windows 8.1 systems use separately created USB, CD, or DVD recovery media, which adds setup work before the scan can begin.

A useful fallback when normal scans are not enough

Windows Defender Offline is a practical offline malware scan for users facing suspicious or persistent threats. Its pre-boot environment gives it a clear purpose beyond ordinary antivirus checks, while its restart requirement keeps it from being a casual everyday tool. It is most valuable as a targeted security measure when Microsoft Defender needs a cleaner view of a system than an active Windows session can provide.