Microsoft Defender Offline review
A free Windows scanner for persistent malware, rootkits, and offline remediation.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Microsoft Defender Offline is an on-demand malware scanner integrated into Windows Security. It is designed for Windows users who need to scan outside the normal operating environment, particularly when persistent malware or rootkits may be difficult to address during a standard Windows session. The workflow uses the Windows Recovery Environment and automatically restarts the device when the scan completes, with results available in Protection history.
The product is free and is delivered as a Windows feature rather than a separately priced standalone application. Windows Security provides quick, full, and custom scan options, along with threat quarantine and removal controls. A quick scan is intended for persistent malware and rootkits, while the offline workflow adds a remediation path outside the regular operating system. Administrators can launch the scan through Windows Security, PowerShell, or Windows Management Instrumentation, giving it a useful fit for managed Windows operations. Older supported Windows versions can also use Microsoft-provided bootable USB, CD, or DVD media.
Its main boundary is platform scope: Microsoft Defender Offline is for Windows devices, not a cross-platform malware removal tool. The automatic restart is part of the workflow, so it requires an appropriate point in the user's work schedule. The bootable-media option is also oriented toward older supported Windows versions, while Windows 10 and Windows 11 generally use the built-in Windows Security and Windows Recovery Environment process. Choose it for free offline remediation on Windows; choose another category option if you need broader operating-system coverage or a separately packaged standalone application.
Microsoft Defender Offline pros and cons
- Where it wins
- Scans outside normal Windows to target persistent malware and rootkits
- Offers quick, full, custom, quarantine, and removal controls
- Supports Windows Security, PowerShell, WMI, and bootable media
- Where it doesn't
- Windows-only platform support
- Offline scans restart the device automatically
- Bootable media applies to older supported Windows versions
Microsoft Defender Offline fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update