>

Run a Microsoft Defender Offline Scan

Reboot into Defender's offline environment to hunt rootkits and stubborn malware before Windows loads.

WindowsantivirusdefendersecurityLow risk
Run Start-MpWDOScan in an admin PowerShell — the PC restarts and scans before Windows starts.

01Command

Command
$ Start-MpWDOScan

02What it does

Modern malware can hide from an in-Windows scan by running as a driver or hooking the OS itself. The offline scan runs from a clean pre-boot environment, so it can catch threats that normal scans miss. The scan runs automatically after the restart and results appear in Windows Security when you log back in.

03Risk

RiskLow risk
RequirementsRun PowerShell as administrator. The PC restarts into the offline scan environment — save your work first.
!Warning: The scan takes 10–15 minutes and blocks the PC during it — save all work before running the command.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • Start-MpWDOScan
    Microsoft Learn · vendor-doc · 2026-09-17
    Evidence: Documents Start-MpWDOScan as the cmdlet that starts a Microsoft Defender offline scan and restarts the computer.

Last verified: 2026-09-18 · Category: Security & Privacy

06Related solutions

Fix 'scripts is disabled on this system' with Set-ExecutionPolicy
WindowsTerminaldevelopersecurity

Understand PowerShell's execution policy scopes and set the one that lets you run your own local scripts without gutting the security model.

Medium risk ✓ 2026-09-17
Take ownership of a file or folder with takeown and icacls
WindowsFilessystemsecurity

Two-step command sequence that makes you the owner of a locked file tree and grants yourself full control — the standard fix for 'Access is denied' on old profiles and OS reinstall leftovers.

High risk ✓ 2026-09-17
Verify File Hashes with certutil -hashfile
Windowshashcmdsecurity

Built-in Windows command to compute MD5, SHA1 or SHA-256 hashes of any file.

Low risk ✓ 2026-09-17