How to Manually Scan for Malware with Windows Defender in Windows 11

Windows Defender (now branded as Microsoft Defender Antivirus) runs automatic background scans by default, but there are times when you need to take control. Maybe you downloaded a suspicious file, noticed unusual system behavior, or want to verify your PC is clean after a software update. Running a manual malware scan gives you immediate visibility into your system’s health and lets you choose exactly how thorough the check should be. This guide shows you how to use Windows Defender to scan for malware manually on Windows 11 without relying on third-party tools.

Before You Start: You will need an active Windows 11 installation with administrator privileges. If you are using Windows 11 Enterprise or Education, some group policy settings may restrict manual scan options, so contact your IT administrator if you encounter locked menus.

1. Open the Windows Security app. Press Win + I to launch Settings, then select System from the left sidebar. Scroll down and click Windows Security. This app serves as the central hub for all built-in protection features, including real-time monitoring, firewall rules, and manual scanning tools. You will see a grid of tiles representing different security categories. If the menu feels cluttered, you can type “Windows Security” into the Start menu search and open it directly from the results. If the app fails to launch, restart your PC and try again immediately after Windows finishes loading.
2. Navigate to Virus & threat protection. In the Windows Security window, click the Virus & threat protection tile. This section displays your current protection status, last scan date, and threat history. You will see a prominent Scan options link directly beneath the “Current threat status” heading. Click that link to reveal the full scanning menu. This page is where Windows Defender stores every scan configuration, so take a moment to review the status indicators before proceeding. If the tile shows a warning icon, click it to address any pending alerts first.



3. Choose your preferred scan type. You will see four distinct scanning modes: Quick scan, Full scan, Custom scan, and Windows Defender Offline scan. Select the option that matches your needs. A quick scan checks high-risk locations like startup folders and memory in about fifteen minutes. A full scan examines every file and running program, which can take several hours. Choose Custom scan if you want to target a specific drive or folder, and pick the Offline scan if you suspect a deeply embedded threat that only loads before Windows boots. If you are unsure which option to pick, start with a quick scan and upgrade to a full scan if the results look suspicious.
4. Start the scan and monitor progress. Click the Scan now button at the bottom of the scan options page. Windows Defender will immediately begin checking your system. You will see a progress bar and an estimated time remaining. Keep your PC plugged into power and avoid running heavy applications while the scan runs. The antivirus will automatically quarantine or remove threats it identifies, but you can pause the scan if you need to step away temporarily. If the progress bar freezes for more than ten minutes, press Ctrl + Shift + Esc to open Task Manager, locate Microsoft Defender Antivirus Service, and restart it.



5. Review and handle detected threats. Once the scan finishes, Windows Defender displays a detailed results page. Click View threat history if you want to see past detections, or stay on the results page to handle current findings. For each detected item, you can choose to Quarantine the file to isolate it safely or Remove it permanently. If a file is flagged as a false positive, you can submit it to Microsoft for review directly from this screen. Always verify the file source before quarantining critical applications, and restart your PC after handling threats to ensure cleaned memory is refreshed.

Pro Tip: Schedule a weekly full scan by clicking Scan options > Full scan > Scan now, then set a reminder in your calendar. Consistent manual checks catch threats that bypass real-time protection.

Troubleshooting Common Issues

Even straightforward scans can run into hiccups. Here is how to resolve the most frequent problems you might encounter when using Windows Defender to scan for malware manually.

• Scan will not start or hangs at zero percent: This usually happens when another antivirus program is running in the background. Open Settings > Apps > Installed apps, locate any third-party security suite, and temporarily disable its real-time protection. If the issue persists, restart your PC and try again immediately after Windows loads. You can also run sfc /scannow in an elevated Command Prompt to repair corrupted system files that may block the scanner.
• Windows Defender is disabled or grayed out: Group policy settings, registry edits, or certain optimization tools can disable built-in protection. Open Settings > Privacy & security > Windows Security and toggle Manage next to Virus & threat protection. If the option remains locked, check your organization’s IT policies or run gpedit.msc to verify that Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus is set to Not Configured. Restoring this setting re-enables manual scanning access.
• Scan completes but threats return immediately: Some malware families hide in startup items or scheduled tasks. After removing detected threats, open Task Manager with Ctrl + Shift + Esc, navigate to the Startup apps tab, and disable anything unfamiliar. Then run a second quick scan to confirm the system stays clean. If the same files keep reappearing, check Control Panel > Scheduled Tasks for suspicious entries and delete them.

Additional Tips for Ongoing Protection

• Keep Real-time protection enabled at all times. Manual scans complement automatic monitoring but do not replace it.
• Update your virus definitions regularly by clicking Scan options > Update definitions when prompted.
• Back up important files to an external drive or cloud storage before running full scans on heavily used systems.
• Disable Controlled Folder Access temporarily if you need to install software that Defender blocks during a scan.

Following these steps gives you full control over your system’s security posture. Windows Defender handles the heavy lifting while you decide when and how deeply to inspect your files.

What type of manual scan do you run most often on your Windows 11 PC?

Over to you: What type of manual scan do you run most often on your Windows 11 PC?

You may also like

How to Manually Scan for Malware Using Windows Defender in Windows 11How to Manually Scan for Malware with Windows Defender on Windows 11How to Manually Scan for Malware Using Windows Defender in Windows 11How to Manually Scan for Malware with Windows Defender on Windows 11