Windows Defender (now branded as Microsoft Defender Antivirus) runs automatic background scans by default, but there are moments when you need to take control. Whether a suspicious download caught your eye, your system feels sluggish, or you want to verify a clean state after a software update, triggering a manual malware scan Windows 11 gives you immediate visibility into your system health. This guide walks you through the exact settings, scan options, and result interpretations so you can confidently clear threats without relying on guesswork.
What You’ll Need: A Windows 11 PC with an active internet connection and administrator privileges. Enterprise environments running Windows 11 Enterprise or Education may have Group Policy restrictions that limit scan options, but the core steps remain identical.
Step 1: Open Windows Security
Click the Start button, type Windows Security, and press Enter to launch the app. This central hub houses all of Microsoft’s built-in protection tools, including firewall controls, account security, and device performance monitoring. You will see a grid of large tiles representing each security category. If the app fails to launch, restart your computer and try again, or press Win + R, type ms-settings:windowsdefender, and hit Enter to force it open.
Step 2: Navigate to Virus & Threat Protection
Click the Virus & threat protection tile in the top row of the Windows Security dashboard. This section manages your antivirus engine, real-time monitoring toggles, and scan history. You will notice a prominent blue link labeled Scan options roughly halfway down the page. Click that link to reveal the menu where you will configure your manual scan. If you do not see the link, scroll down until the Current threats section appears.
Step 3: Select Your Preferred Scan Type
Choose one of the four available scan modes based on your needs and system performance. Quick scan checks startup folders, running processes, and common malware hiding spots in roughly five to ten minutes. Full scan inspects every file and folder on your drives, which takes significantly longer but catches deeply embedded threats. Custom scan lets you pick specific folders or drives to investigate, ideal for targeting a suspicious USB drive or external storage. Windows Defender Offline scan reboots your PC into a secure environment to remove rootkits that resist normal scanning. Select the option that matches your situation and click Scan now.
Step 4: Launch the Manual Scan
Allow the scanning process to run without interrupting it or closing the window. You will see a progress bar and a live counter showing how many files have been checked. The system may feel temporarily sluggish while Defender indexes your storage, which is completely normal. If the scan stalls at a specific percentage for more than an hour, press Ctrl + Shift + Esc to open Task Manager, locate WindowsDefender under the Background processes tab, and restart it. You can also pause the scan temporarily by clicking the pause icon in the top right corner if you need to use the computer for an urgent task.
Step 5: Review Results and Quarantine Threats
Wait for the scan to finish, then read the action prompts next to each detected item. Windows Defender will classify findings as threats, potentially unwanted apps, or clean items. Click Take action on any flagged entries to quarantine or remove them. Quarantined items are moved to a secure folder where they cannot execute, but you can restore them later if you suspect a false positive. After processing all alerts, click Scan again to verify that your system is completely clean.
Troubleshooting Common Scan Issues
If Windows Defender refuses to start a manual scan, check your definition updates first. Open Windows Security > Virus & threat protection > Virus & threat protection settings > Update now under Antivirus updates. Outdated definitions are the leading cause of failed or ineffective scans. If the scan completes but threats reappear, disable real-time protection temporarily. Go to Virus & threat protection settings and toggle Real-time protection off, then run your manual scan again. Some malware families actively block security tools while they are active, so a brief pause allows Defender to clean the system completely. If you receive an error code like 0x80070005 or 0x80070002, run the Windows Defender Troubleshooter. Navigate to Settings > System > Troubleshoot > Other troubleshooters, locate Windows Security, and click Run. The built-in tool repairs corrupted registry keys and resets service permissions automatically. If your organization manages the device, contact your IT administrator. Domain policies can lock scan configurations to prevent users from bypassing corporate security protocols.
Pro Tip: Schedule a weekly quick scan by enabling Cloud-delivered protection and Automatic sample submission in your Virus & threat protection settings. These features feed threat intelligence to Microsoft’s servers and help Defender recognize zero-day malware faster.
Running a manual malware scan Windows 11 takes less than five minutes when you know where to look. Keep Windows Defender updated, review scan results regularly, and pair this built-in tool with safe browsing habits for the strongest possible defense. Your system will stay responsive, and you will catch suspicious activity before it escalates into a full infection.
Over to you: Have you ever caught a hidden threat by running a manual scan, or does your PC stay clean on its own?
