How to Fix Microsoft Defender Offline Scan Not Working in 2026
If you are trying to run Microsoft Defender Offline Scan and it refuses to start, reboot, or finish, the issue is usually tied to Windows Security, update integrity, or recovery environment problems.
This guide explains the most common causes and the exact fixes that restore offline scanning without guesswork.
What Microsoft Defender Offline Scan Does
Microsoft Defender Offline Scan is a Windows security feature that restarts your computer into a trusted environment before Windows fully loads.
This allows Microsoft Defender Antivirus to detect and remove persistent threats such as rootkits, boot-sector malware, and malicious services that can hide during a normal scan.
Because it runs outside the standard Windows session, the scan depends on several components working correctly: Windows Security app settings, Windows Recovery Environment, Windows Update, and the integrity of Microsoft Defender files.
If any of these are damaged or disabled, the offline scan may fail to launch.
Common Reasons the Offline Scan Stops Working
- Windows Security app is corrupted or disabled
- Microsoft Defender Antivirus is turned off by policy or another antivirus
- Windows Recovery Environment is disabled
- Pending updates are blocking Defender components
- System files or security definitions are damaged
- Boot configuration or disk errors prevent reboot-based scanning
- Group Policy or registry settings block offline scans
Check Whether Microsoft Defender Is Active
Before troubleshooting the offline scan itself, confirm that Microsoft Defender Antivirus is the active security provider.
If a third-party antivirus is installed, it may disable Defender features or interfere with scan scheduling.
- Open Windows Security.
- Go to Virus & threat protection.
- Look for status messages under Who’s protecting me? or Virus & threat protection settings.
If another antivirus is active, uninstall it completely, restart the PC, and check whether Defender reactivates.
In many cases, offline scan options return only after the competing product is removed.
Update Windows Security and Defender Definitions
Outdated security intelligence can prevent scans from starting correctly.
Windows Defender depends on current definitions and platform updates to prepare the offline environment.
Use these steps:
- Open Windows Security.
- Go to Virus & threat protection.
- Select Protection updates.
- Click Check for updates.
You can also force a definition refresh from an elevated Command Prompt:
MpCmdRun.exe -SignatureUpdate
If Windows Update is broken, resolve update failures first.
Defender often relies on healthy servicing components, especially on Windows 10 and Windows 11 systems that have been pending cumulative updates for a long time.
Make Sure Windows Recovery Environment Is Enabled
Microsoft Defender Offline Scan uses the Windows Recovery Environment, often called WinRE.
If WinRE is disabled, missing, or damaged, the offline scan may not launch at all.
Check WinRE status in an elevated Command Prompt:
reagentc /info
Look for Windows RE status.
If it says Disabled, enable it with:
reagentc /enable
If the recovery image path is missing or incorrect, Windows may need repair using installation media or an in-place upgrade.
A broken WinRE installation is one of the most overlooked reasons users search for how to fix Microsoft Defender offline scan not working.
Run the Scan the Correct Way
Sometimes the feature appears broken because it is launched from the wrong menu or interrupted by a stale app state.
Start the scan from the Windows Security interface rather than relying on shortcuts or third-party tools.
- Open Windows Security.
- Choose Virus & threat protection.
- Under Current threats or Scan options, select Microsoft Defender Offline scan.
- Click Scan now.
Save your work before starting, because the computer will restart.
If the scan option is missing, that usually points to policy restrictions, a damaged Security app, or WinRE issues rather than a simple scan failure.
Repair the Windows Security App
The Windows Security app itself can become corrupted, especially after major feature updates or system cleanup tools.
Repairing or resetting the app often restores missing Defender controls.
Try these steps in order:
- Go to Settings > Apps > Installed apps.
- Find Windows Security if it appears as a repairable app.
- Select Advanced options.
- Click Repair, then Reset if needed.
If the interface still behaves strangely, use the System File Checker and DISM tools to repair protected Windows components.
Run System File Checker
sfc /scannow
Repair the Windows image
DISM /Online /Cleanup-Image /RestoreHealth
After these commands complete, restart the PC and try the offline scan again.
Check for Group Policy or Registry Blocks
On managed devices, Microsoft Defender features may be disabled by local policy, domain policy, or device management tools such as Microsoft Intune.
If the device is corporate-managed, policy settings may override local troubleshooting.
Look for these possibilities:
- Turn off Microsoft Defender Antivirus policy is enabled
- Security Intelligence updates are restricted
- Windows Recovery Environment access is limited
- App and browser protection is controlled by MDM
On Windows Pro or Enterprise editions, open the Group Policy Editor and review Defender-related policies under Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus.
If a policy is enforced by an administrator, change requests must be made at the management level.
Use Safe Mode or Clean Boot to Remove Interference
Security software, startup tools, and driver-level utilities can interfere with offline scan preparation.
A clean boot helps isolate whether a background app is causing the failure.
To test this:
- Open System Configuration using
msconfig. - Hide Microsoft services and disable the rest temporarily.
- Disable startup apps in Task Manager.
- Restart the computer and try Microsoft Defender Offline Scan again.
If the scan works in a clean boot state, re-enable services gradually until the conflicting software is identified.
Repair Boot and Disk Problems
Offline scans rely on a healthy boot chain and readable system volume.
File-system errors, corrupted boot records, or failing drives can prevent the restart process from completing.
Run these checks from an elevated Command Prompt:
chkdsk C: /f
bootrec /scanos
bootrec /rebuildbcd
If you suspect hardware issues, check SMART status with a disk utility and back up important files immediately.
A drive that is deteriorating can cause repeated scan failures, black screens, or boot loops after the offline scan begins.
Reset or Reinstall Windows Security Components
If none of the above fixes work, the Windows security stack may be too damaged for minor repairs.
An in-place repair install of Windows 11 or Windows 10 preserves files and apps while replacing corrupted system components, including Defender-related files.
This is often the most reliable fix when:
- WinRE cannot be re-enabled
- Windows Security is missing or broken
- SFC and DISM report unresolved corruption
- Offline scan options disappear after upgrades
Use the latest Windows ISO from Microsoft and choose the repair install option rather than a clean install if you want to keep your data and applications.
When to Escalate the Problem
If Microsoft Defender Offline Scan still will not start after repairs, the issue may be tied to firmware settings, system encryption, or hardware instability.
In those cases, review Secure Boot, BitLocker status, BIOS updates, and any recent driver changes.
If the machine is business-managed, involve IT before making policy changes that could weaken endpoint protection.
For most home users, the fastest path is to verify Defender is active, update definitions, enable WinRE, repair Windows Security, and then test again.
Those steps resolve the majority of cases where Microsoft Defender Offline Scan not working becomes a recurring problem.