How to Run a Windows Defender Scan on Windows 11

To run a Windows Defender scan on Windows 11, open Windows Security, select Virus & threat protection, and click Quick scan. For a deeper check, click Scan options, choose Full scan, Custom scan, or Microsoft Defender Antivirus (offline scan), and click Scan now.

Windows Defender is now called Microsoft Defender Antivirus, and it’s built into the Windows Security app on every Windows 11 PC. These steps are current for Windows 11 versions 24H2 and 25H2 as of October 2026. Windows 10 uses the same Windows Security app, so the steps are the same there too.

Run a Quick Scan

A quick scan checks the places malware usually hides, like startup items and system folders. It typically finishes in a few minutes and is the right choice for a routine check.

1. Click Start, type Windows Security, and open the app. You can also click the shield icon in the hidden-icons area at the right end of the taskbar.
2. Select Virus & threat protection. Under Current threats, you’ll see when the last scan ran and how many files it checked.
3. Optional but recommended: scroll to Virus & threat protection updates, select Protection updates, and click Check for updates. This gets the latest threat definitions. Click the back arrow when it finishes.
4. Click Quick scan. A progress bar shows the scan running, and you can keep working while it does.

5. When it finishes, Windows Security reports No current threats or lists what it found. If it thinks you need a deeper scan, it tells you.

Microsoft describes each scan option in its Windows Security virus and threat protection guide.

Run a Full, Custom or Offline Scan

1. Open Windows Security and select Virus & threat protection.
2. Under Current threats, click Scan options.
3. Select the scan type you want (described below). Selecting the option doesn’t start the scan.
4. Click Scan now.

Full scan starts with a quick scan and then checks every file and running program on your fixed drives. It can take an hour or more on a computer with lots of files, and your PC may feel slower while it runs. Keep a laptop plugged in and don’t let it sleep. Use it when you suspect an infection or a quick scan recommends it.

Custom scan checks only the folder or drive you pick. After you click Scan now, a window opens so you can choose the location. This is the fastest way to check a USB flash drive or your Downloads folder.

Microsoft Defender Antivirus (offline scan) restarts your PC and scans from outside Windows, which helps remove malware that hides while Windows is running. It takes about 15 minutes, then Windows starts normally. Before you click Scan now:

• Save your work and close your apps, because the PC restarts right away.
• If BitLocker or device encryption is on, have your recovery key ready, since you may be asked for it during the restart. Microsoft recommends suspending BitLocker first.
• Know that it needs an administrator account and doesn’t work on ARM-based PCs (such as Snapdragon laptops). Microsoft lists the requirements in its Defender Offline documentation.

Offline scan results appear in Protection history after Windows restarts.

Scan a Single File or Folder

1. Open File Explorer and find the file, folder or drive.
2. Right-click it and select Show more options.
3. Select Scan with Microsoft Defender. Windows Security opens and shows the result for that item only.

This is a good habit for downloaded installers and files from a USB drive before you open them. Microsoft covers it in Scan an item with Windows Security.

Run a Scan From PowerShell

If you prefer the command line, or the Windows Security buttons aren’t working, you can start a scan from PowerShell.

1. Right-click Start and select Terminal (Admin). Click Yes on the User Account Control prompt.
2. Make sure the tab says Windows PowerShell or PowerShell, not Command Prompt.
3. Type Start-MpScan -ScanType QuickScan and press Enter for a quick scan, or Start-MpScan -ScanType FullScan for a full scan.
4. Wait for the prompt to return. Any detections appear in Protection history in Windows Security.

To scan one folder, use Start-MpScan -ScanType CustomScan -ScanPath "C:\Users\YourName\Downloads" with your own path. Microsoft documents Start-MpScan and its options.

What to Do if Defender Finds a Threat

1. Read the message at the end of the scan. Defender quarantines or removes most threats automatically.
2. If it offers a button such as Start actions, click it to let Defender deal with the remaining items.
3. Open Protection history (in the Windows Security left pane, or the link on the Virus & threat protection page) to see each detection, its severity and the action taken.

4. Select a detection to see details. Choose Allow or Restore only if you’re certain the file is safe, such as a tool you’ve used for years that’s being flagged by mistake.
5. Restart the PC if Defender asks, then run a Full scan to make sure nothing was missed.

If you allowed something by mistake, go to Virus & threat protection, select Allowed threats, pick the item, and choose Don’t allow.

Troubleshooting

There’s no Quick scan button. Another antivirus program is probably active, and Windows Security shows that program’s name instead of Defender’s scan controls. To check, open Windows Security > Settings > Manage providers and look at the Antivirus entry. Run your scan from that program. If it’s Norton, our guide on scanning a USB drive with Norton 360 shows where its scan controls are.

The scan won’t start or stops right away. Install pending updates in Settings > Windows Update, restart the PC, and try again. Starting the scan from PowerShell (above) often shows an error message that explains the problem.

A full scan is taking hours. That’s normal for large drives or folders with many small files. As long as the file count or current path keeps changing, it’s working. If you only need to check one location, cancel it and use a custom scan instead.

Real-time protection is off. Under Virus & threat protection settings, select Manage settings and turn Real-time protection on. On a work or school PC, these settings may be controlled by your organization, so ask your IT team.

Frequently Asked Questions

Do I need to run Defender scans manually?

Usually not. Defender scans files as you open them and runs scheduled background scans. A manual scan makes sense when your PC starts acting strangely, such as unexpected pop-ups, browser redirects, or a sudden slowdown. If a scan comes back clean and the PC is still slow, try our guide on how to fix a slow computer in Windows 11.

Should I run a quick scan or a full scan?

Start with a quick scan. Run a full scan if the quick scan finds something, recommends it, or you still think something is wrong. For a stubborn infection, follow up with an offline scan.

Where can I see past scan results?

In Windows Security, select Protection history. It lists detections and the actions Defender took, including results from offline scans. The Current threats section shows when the last scan ran.

Can I schedule a Defender scan?

Defender already scans on its own schedule. To set your own time, open Task Scheduler, go to Task Scheduler Library > Microsoft > Windows > Windows Defender, double-click Windows Defender Scheduled Scan, and add a trigger on the Triggers tab. Microsoft walks through it in Schedule a scan in Microsoft Defender Antivirus.

How do I turn off Defender temporarily?

See our guide on how to turn off Windows Defender in Windows 11. Turn it back on as soon as you’re done.