I fix this problem several times a week. The Windows Defender offline scan not working issue has a handful of real causes and most of them are fixable in under half an hour. Forget the forum rabbit holes. Here's what actually works.

TL;DR

Windows Defender offline scan not working is almost always caused by a disabled Windows Recovery Environment, corrupted system files, or Defender being pushed into passive mode by a second antivirus. Run reagentc /info first. If WinRE is disabled, that's your answer. If not, work through SFC, DISM, and the PowerShell override below.

⏳️ 13 min read ✅ 85% success rate 📅 Updated August 2026

Key Takeaways

Windows Defender offline scan not working is most often caused by WinRE being disabled or corrupted.
A second antivirus puts Defender into passive mode and blocks the offline scan from starting.
SFC and DISM repair the underlying system files that the offline scan depends on.
PowerShell's Start-MpWDOScan bypasses the Windows Security UI if the GUI won't cooperate.
A bootable Defender Offline USB is the most reliable fallback when everything else fails.

At a Glance

Difficulty: Medium
Time Required: 15 to 45 mins
Success Rate: 85% of users

What Causes Windows Defender Offline Scan Not Working?

The offline scan is different from a normal Defender scan. It doesn't run inside Windows. It reboots your machine into a stripped-down Windows PE environment (basically a mini version of Windows) and scans from there, which is exactly why it can catch rootkits and boot-sector malware that a normal scan misses. But that also means it has more ways to go wrong.

The single most common cause I see is a disabled or broken Windows Recovery Environment. Defender Offline needs WinRE to boot into that pre-Windows scanning environment. No WinRE, no scan. Simple as that. The second most common cause is a second antivirus being installed. When Windows detects another AV product, it automatically puts Defender into passive mode. Passive mode Defender won't run an offline scan. It just quietly refuses.

Beyond those two, you're usually looking at corrupted system files (which SFC and DISM sort out), outdated or broken Defender definitions, or firmware settings like Fast Boot or Legacy/CSM mode that interfere with the boot-time environment. Here's a quick breakdown:

WinRE disabled or corrupted: The offline scan can't launch without a working recovery environment.
Defender in passive mode: A third-party antivirus installed alongside Defender will trigger this.
Corrupted Defender or system files: Damaged platform files or a broken signature database cause crashes or blank scans.
Outdated definitions: Partially updated definitions can cause the offline scanner to crash on startup.
BIOS/UEFI boot settings: Fast Boot, Legacy/CSM, or Secure Boot misconfigurations can block the offline environment from loading.

Worth noting: if you're dealing with malware that's actively fighting back against scans, a good dedicated antivirus product can complement Defender's offline capability. Independent testing labs like AV-TEST and AV-Comparatives regularly benchmark how well products handle persistent and boot-level threats. Worth a look if you're evaluating your options.

Windows Defender Offline Scan Not Working: Quick Fix

Start here. These take five to ten minutes and fix the problem more often than you'd expect.

Check WinRE and Retry the Scan Easy

Check WinRE status
Open Start, type cmd, right-click Command Prompt and choose Run as administrator. Run: reagentc /info. Look for the line that says Windows RE status. It should say Enabled.
Enable WinRE if it's disabled
If it says Disabled, run: reagentc /enable. Then run reagentc /info again to confirm it now shows Enabled. This alone fixes the problem in a large chunk of cases.
Retry the offline scan
Open Settings, go to Update and Security, then Windows Security, then Virus and threat protection. Click Scan options, choose Microsoft Defender Offline scan, and click Scan now. Let it reboot.

If the system reboots into the scanning environment and starts scanning, you're sorted. Let it complete fully before the machine boots back into Windows.

Update Windows and Defender Definitions Easy

Install pending Windows updates
Go to Settings, Update and Security, Windows Update. Click Check for updates and install everything pending. This refreshes Defender platform binaries along with Windows components.
Force a definition update
In elevated Command Prompt, run: "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -SignatureUpdate. This explicitly pulls the latest signatures rather than waiting for the background update cycle.
Reboot and retry
Restart the machine after updates complete, then attempt the offline scan again from Windows Security.

Outdated definitions are a surprisingly common cause of the Windows Defender offline scan not working issue. The offline scanner needs current definitions to initialise properly.

Check Defender Isn't in Passive Mode Easy

Open Windows Security
Go to Windows Security, then Virus and threat protection. If you see a message saying another antivirus is protecting your device, Defender is in passive mode.
Disable or uninstall the third-party antivirus
Temporarily disable it from its own settings, or uninstall it via Settings, Apps. Reboot after removal.
Confirm Defender is now active
Reopen Windows Security. Defender should now show as active and real-time protection should be on. Retry the offline scan.

Don't run two antivirus products at once. It causes conflicts, slows your machine down, and as you can see, breaks features like the offline scan.

More Windows Defender Offline Scan Not Working Solutions

If the quick fixes didn't sort it, the problem is probably a bit deeper. These intermediate fixes cover corrupted system files and third-party interference. Expect 15 to 30 minutes here.

Run SFC to Repair System Files Medium

Open elevated Command Prompt
Right-click Start, select Windows Terminal (Admin) or Command Prompt (Admin).
Run SFC
Type: sfc /scannow and press Enter. This will take several minutes. Don't close the window.
Read the result
If it says Windows Resource Protection found corrupt files and repaired them, reboot and retry the offline scan. If it says it found files it could not repair, move on to DISM below.

SFC repairs the core Windows system files that both WinRE and Defender depend on. Corruption here is more common than people think, especially after a forced shutdown or a dodgy update.

Run DISM to Repair the Windows Image Medium

Run a health check first
In elevated Command Prompt: DISM /Online /Cleanup-Image /CheckHealth. This is quick and tells you if corruption is detectable.
Run a deeper scan
DISM /Online /Cleanup-Image /ScanHealth. This takes longer (up to 10 minutes) but does a thorough check.
Repair the image
DISM /Online /Cleanup-Image /RestoreHealth. This pulls replacement files from Windows Update. Needs an internet connection. Can take 20 minutes or more.
Reboot and retry
After DISM completes, reboot. Run sfc /scannow again to confirm everything is clean, then retry the offline scan.

DISM goes deeper than SFC. It repairs the underlying Windows image that SFC pulls replacement files from. If SFC couldn't fix something, DISM usually can.

Clean Boot to Isolate Third-Party Interference Medium

Open msconfig
Press Win + R, type msconfig, press Enter.
Disable non-Microsoft services
On the Services tab, tick Hide all Microsoft services, then click Disable all.
Disable startup items
On the Startup tab, click Open Task Manager. Disable every non-Microsoft startup item.
Reboot and test
Restart the machine and try the offline scan. If it works in Clean Boot, a third-party service or driver is the culprit. Re-enable services in batches to find it.

This is especially useful if you have endpoint security software, VPN clients, or disk encryption tools installed. Any of these can interfere with the boot-time scanning environment.

While you're in this area, it's also worth checking Event Viewer for clues. Right-click Start, open Event Viewer, and navigate to Applications and Services Logs, then Microsoft, then Windows, then Windows Defender, then Operational. Look for errors around the time you attempted the scan. The event details often name the exact component that failed, which saves a lot of guesswork. This is the same approach I use when diagnosing other tricky system-level issues, like when someone's desktop shortcuts have gone missing after a Windows update and it turns out a shell extension is the real culprit.

Advanced Windows Defender Offline Scan Not Working Fixes

Still not working? These are the heavy-hitter fixes. They require a bit more confidence with the command line and BIOS, but they have a high success rate for persistent cases.

Force the Offline Scan via PowerShell Hard

Open elevated PowerShell
Right-click Start, select Windows PowerShell (Admin) or Terminal (Admin).
Run the command
Type: Start-MpWDOScan and press Enter. This calls the Defender API directly, bypassing the Windows Security GUI entirely.
Let it reboot
The system will reboot into the offline scanning environment. Don't interrupt it. The scan typically takes 10 to 20 minutes depending on drive size.

This is useful when the Windows Security interface itself is broken or when the Scan options button doesn't respond. The underlying Defender service is often still functional even when the UI isn't.

Check BIOS/UEFI Boot Settings Hard

Enter firmware setup
Reboot and press the firmware key during POST. This is usually Esc, F10, F2, or Del depending on your manufacturer. HP machines often use Esc then F10.
Check Secure Boot
Ensure Secure Boot is enabled. It should be on for Windows 11 machines. If it was turned off for some reason, re-enable it.
Disable Fast Boot and Legacy/CSM
Fast Boot can skip initialisation steps that WinRE needs. Legacy/CSM mode conflicts with UEFI-based recovery tools. Disable both if present.
Load defaults if unsure
Most BIOS menus have a Load Optimised Defaults or Restore Factory Settings option. Use it if you're not sure what's been changed. Save and exit.

Be careful in BIOS. Only change the settings mentioned above. Changing things like SATA mode or boot order incorrectly can stop Windows from booting at all.

Create a Bootable Defender Offline USB Hard

Download the tool on a clean PC
Go to the Microsoft Defender Offline documentation page and download the tool. Use a different machine if you're worried the affected PC is compromised.
Create the bootable USB
Run the tool and follow the prompts to write to a USB drive (at least 1GB). It downloads current definitions and writes a bootable PE environment.
Boot the affected PC from USB
Plug the USB into the affected machine, reboot, and select the USB from the boot menu (usually F12 or F9 during POST). The scan will start automatically.
Let it complete
The scan runs fully outside Windows. Any threats found will be reported and quarantined before Windows loads. This is the most thorough method available.

This is the gold standard fallback. It completely sidesteps local WinRE issues, Defender configuration problems, and any malware that might be actively blocking scans from within Windows.

Repair or Resize the WinRE Partition Hard

Check partition size
Open Disk Management (right-click Start, select Disk Management). Find the Recovery partition. If it's under 500MB, it may be too small for the offline scanner and its current definitions.
Back up your data first
This is non-negotiable before touching partitions. Use File History, a backup drive, or image the entire disk. If something goes wrong with partition work, you want a recovery point. Speaking of which, if you ever need to recover deleted photos on Windows after a disk operation gone wrong, that guide covers the main options.
Follow Microsoft's WinRE documentation
Microsoft has specific guidance for extending or recreating the WinRE partition. Search learn.microsoft.com for 'WinRE partition resize'. The exact steps vary by Windows version and partition layout.
Re-enable WinRE
After any partition changes, run reagentc /enable in elevated Command Prompt and confirm with reagentc /info.

Partition work carries real risk. If you're not confident, use the bootable USB method above instead. It achieves the same result without touching your disk layout.

Preventing Windows Defender Offline Scan Not Working

Most of these issues are preventable. Here's what actually matters, in order of importance.

Keep WinRE enabled. Run reagentc /info every few months, especially after any disk work, partition changes, or major Windows upgrades. It takes ten seconds. If it ever shows Disabled, run reagentc /enable immediately. Don't wait until you need the offline scan to find out it's broken.

Don't run two antivirus products. Pick one. If you're using Defender, don't install a second AV on top of it. If you switch to a third-party product, make sure Defender is properly deactivated. Passive mode Defender is not protecting you properly and it won't run offline scans.

Run SFC and DISM after anything unusual. Forced shutdowns, failed updates, unusual crashes, anything like that. Run sfc /scannow as a matter of habit. It takes a few minutes and catches corruption early before it causes bigger problems.

Keep Windows updated. Defender's platform binaries and definitions ship through Windows Update. Machines that are months behind on updates often have definition mismatches that cause the offline scanner to crash on startup. Turn on automatic updates and leave them on.

Keep your BIOS/UEFI firmware current. Firmware updates fix compatibility issues with Windows recovery tools. Check your manufacturer's support page a couple of times a year. And keep Secure Boot enabled. Disabling it for gaming or other reasons can cause subtle problems with WinRE and the offline environment. Similarly, keeping your hardware drivers current prevents the kind of system instability that can corrupt WinRE in the first place. If you ever run into driver-related oddities on other hardware, the same systematic approach applies, whether that's sorting out an external HDD not showing in Windows or tracking down why a peripheral stopped being recognised.

Windows Defender Offline Scan Not Working: Summary

The Windows Defender offline scan not working problem almost always comes down to one of three things: WinRE is disabled, Defender is in passive mode because of a second antivirus, or system files are corrupted. Check WinRE first with reagentc /info. If that's fine, check for a conflicting AV. If that's fine, run SFC and DISM. For cases where the GUI won't cooperate, Start-MpWDOScan in PowerShell bypasses it entirely. And if all else fails, the bootable Defender Offline USB is the most reliable option available. It's the method I fall back on when a machine is in a proper state and I need a clean scan result I can trust.