How to run a full scan and an offline scan with Windows Security

By Losa · Last reviewed September 24, 2026 · 3 min read

Every Windows 10 and 11 computer includes Microsoft Defender Antivirus, part of the Windows Security app, at no extra cost. It scored the maximum 6 out of 6 for protection in AV-TEST's February 2026 evaluation. Here's how to use it properly when you want to be sure your computer is clean.

Already have other antivirus installed? Then use that product's own scan instead. Windows automatically steps back when another antivirus is active, so the options below may be grayed out. That's normal.

Step 1: check protection is switched on

Click Start, type Windows Security, and open the app.
Select Virus & threat protection.
Under Virus & threat protection settings, click Manage settings and make sure Real-time protection is on.
Back on the previous screen, click Protection updates → Check for updates, so the scan uses the latest threat information.

Step 2: choose the right kind of scan

Under Virus & threat protection → Scan options you'll see several choices:

Scan	What it does	Use it when
Quick scan	Checks the places threats most often hide. Takes a few minutes.	A routine check, or something just seemed odd
Full scan	Checks every file and running program. Can take an hour or more.	You think something may actually be wrong
Custom scan	Checks only the folder or drive you choose.	Checking a USB drive or a downloads folder
Microsoft Defender Offline scan	Restarts the computer and scans before Windows fully loads.	A threat keeps coming back, or a full scan can't remove it

Step 3: run a full scan

In Scan options, select Full scan.
Click Scan now. You can keep using the computer while it runs, though it may be slower.
If anything is found, Windows Security lists it and recommends an action. Choose the recommended action (usually Remove or Quarantine) and click Start actions.

Step 4, if needed: run the offline scan

Some malware is designed to hide from scans while Windows is running. The offline scan gets around this by checking your computer in a special environment before Windows fully starts.

One exception: according to Microsoft, the offline scan isn't available on Windows computers with ARM processors, which includes many recent Snapdragon-based laptops. If the option doesn't appear for you, that's likely why, and a full scan is the best alternative.

Before you start: save your work and close your programs, because the computer will restart. If your drive uses BitLocker encryption, Microsoft advises suspending BitLocker first, or have your recovery key ready, because you may be asked for it during the restart.

Go to Windows Security → Virus & threat protection → Scan options.
Select Microsoft Defender Offline scan, then click Scan now.
Confirm the restart. The scan usually takes around 15 minutes, and the computer restarts back into Windows when it finishes.

Step 5: check the results

To see what was found and what action was taken, go to Windows Security → Virus & threat protection → Protection history.

If the scan finds nothing, but something still seems wrong

Pop-ups and odd ads are usually caused by browser notifications or extensions, which aren't always flagged as malware. See how to stop pop-ups and browser hijackers.
A frightening warning with a phone number is a scam web page, not a real detection. See is that virus pop-up real?
The computer is just slow: that's more often caused by too many programs starting up, a nearly full drive, or old hardware than by malware.

A word of caution: never download a "scanner" from a link in a pop-up, email or advert. Use Windows Security, or open the antivirus you already own from your Start menu.