Windows Defender (now officially called Microsoft Defender Antivirus) runs automatic background scans by default, but there are moments when you need to take control. Maybe you downloaded a suspicious file, noticed unusual system behavior, or received a warning from a third-party security tool. Running a manual malware scan gives you immediate visibility into your system’s health and lets you choose exactly how deep the investigation goes. This guide walks you through the complete process for Windows 11, including the three primary scan types and what to do when the results come back.
Before You Start: You will need an active Windows 11 installation with administrator privileges. If you are running Windows 11 Home, the steps are identical. Windows 11 Pro, Enterprise, and Education users will find the same interface, though group policy settings in managed environments may restrict certain options.
Step 1: Open the Windows Security app
Press Win + I to launch Settings, then select System from the left sidebar. Scroll down and click Windows Security at the bottom of the list. Alternatively, you can press Win + R, type windowsdefender://, and hit Enter. This app serves as the central hub for all Microsoft Defender features, including real-time protection, firewall controls, and scan configurations. You will know you are in the right place when you see four large tiles representing different security categories.
Step 2: Navigate to Virus & threat protection
Click the Virus & threat protection tile to enter the scanning dashboard. You will see a summary of your current protection status, recent activity logs, and a quick link to run a scan. This section is where Microsoft Defender stores all scanning configurations, threat history, and cloud-delivered protection settings. If you do not see this tile, verify that Windows Update is active and that your system has downloaded the latest security definitions.
Step 3: Select your preferred scan type
Under the Current threats heading, click the Scan options link. You will see four distinct choices: Quick Scan, Full Scan, Custom Scan, and Windows Defender Offline Scan. Each option serves a different purpose depending on your situation. Quick Scan checks the most common malware hiding spots in under ten minutes and is ideal for routine checks. Full Scan examines every file and running program across all drives, which can take several hours but provides the most thorough cleanup. Custom Scan lets you pick specific folders or external drives to investigate, saving time when you suspect a particular directory. Offline Scan reboots your PC and runs a deep scan before Windows fully loads, which is ideal for stubborn threats that hide in memory or modify system files.
Step 4: Initiate the scan and monitor progress
Click the scan type you want, then select Scan now. Windows Defender will immediately begin its investigation and display a progress bar with an estimated time remaining. You can minimize the window and continue using your PC during a Quick Scan, but a Full Scan or Offline Scan will consume significant system resources. Do not force a restart while a scan is running, as interrupting the process can leave your system in an inconsistent state. If the progress bar appears stuck, wait at least fifteen minutes before intervening, since large drives or heavily fragmented storage can slow the indexing process.
Step 5: Review the results and take action
Once the scan finishes, Windows Defender will display a detailed report listing any detected threats, their severity, and the location of each file. Click Show details next to any item to see the exact threat name and recommended action. For each detected item, you will see three options: Quarantine, Remove, and Allow on device. Quarantine isolates the file so it cannot execute while allowing you to restore it later if it was a false positive. Remove permanently deletes the threat, and Allow on device bypasses protection for that specific file. After handling every listed item, click Close to return to the main dashboard.
Troubleshooting Common Scan Issues
If Windows Defender refuses to start a scan, first verify that real-time protection is enabled by returning to the Virus & threat protection main page and checking the toggle under Virus & threat protection settings. If the scan window opens but freezes, temporarily disable any third-party antivirus software, as two active protection engines will conflict and block scanning operations. Should you encounter error code 0x80070005, run the Windows Security Troubleshooter by navigating to Settings > System > Troubleshoot > Other troubleshooters, then click Run next to Windows Security. If threats keep reappearing after removal, boot into Safe Mode and repeat the Offline Scan, as some malware families reinstall themselves from hidden startup entries. You can also reset the Defender service by opening services.msc, locating Microsoft Defender Antivirus Service, and clicking Restart.
- Scan won’t start: Ensure you are signed in with an administrator account and that parental controls are not blocking security tools.
- Scan runs extremely slowly: Close background applications, disconnect unnecessary external drives, and check your storage health in
Settings > System > Storage. - Threats return after cleaning: Run a second Offline Scan after removing the initial batch, then check
msconfigfor suspicious startup items.
Pro Tip: Schedule a weekly Quick Scan by clicking the three-dot menu next to Scan options and selecting Schedule a scan. This keeps your system under routine surveillance without requiring manual intervention.
Regular manual scans complement the built-in real-time protection and give you peace of mind when you suspect compromise. Keep Windows Defender updated by enabling automatic updates in Windows Update settings, as new threat signatures arrive daily. If you continue experiencing persistent infections despite multiple Defender scans, consider using a dedicated second-opinion scanner for a deeper cleanup. Always back up important files before running aggressive removal actions, since legitimate software can occasionally trigger false positives.
Over to you: Have you ever caught a hidden threat by running a manual Windows Defender scan, or do you rely entirely on automatic protection?
