Window defender offline tool

TubeMate 3. Google Play. Biden to send military medical teams to help hospitals. N95, KN95, KF94 masks. GameStop PS5 in-store restock. Baby Shark reaches 10 billion YouTube views. Microsoft is done with Xbox One. Windows Windows. Most Popular. New Releases. Desktop Enhancements. Networking Software. Trending from CNET. Download Now. Developer's Description By Microsoft. Windows Defender Offline is a standalone software application that is designed to help detect malicious and other potentially unwanted software, including rootkits that try to install themselves on a PC.

The primary benefit of using this tool is that it runs before malware, such as rootkits, can hide. It might also provide valuable information on the malware infection that could help to protect other systems in the environment.

The primary benefit of using this tool is that it runs before malware, such as rootkits, can hide. When you perform a post-event malware scan and remediation by running the scan on a system infected with advanced low-level malware, the malware has a chance to run first.

You will be prompted to run a scan:. Armed with up-to-date definition files, Windows Defender Offline can detect malicious and potentially unwanted software, and then notify you of the risks. Read other parts of this series. The need to perform an offline scan will also be revealed in Microsoft Endpoint Manager if you're using it to manage your endpoints. Microsoft Defender Offline scans are indicated under Malware remediation status as Offline scan required. Microsoft Defender Offline notifications are configured in the same policy setting as other Microsoft Defender AV notifications.

For more information about notifications in Windows Defender, see the Configure the notifications that appear on endpoints topic. Before you use Microsoft Defender Offline, make sure you save any files and shut down running programs. The Microsoft Defender Offline scan takes about 15 minutes to run. It will restart the endpoint when the scan is complete.

The scan is performed outside of the usual Windows operating environment. The user interface will appear different to a normal scan performed by Windows Defender. After the scan is completed, the endpoint will be restarted and Windows will load normally. The following WMI script snippet will immediately run a Microsoft Defender Offline scan, which will cause the endpoint to restart, run the offline scan, and then restart and boot into Windows. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for Defender for Cloud.

Microsoft Defender Offline scan results will be listed in the Scan history section of the Windows Security app.