Share via

How can I tell if a Windows Defender offline scan ran successfully?

Anonymous
2025-02-11T03:32:48+00:00

I am running MS Win 11 Pro Version 24H2 (OS Build 26.100.2894)

This should be up to date.

I set up a Microsoft Defender Offline Scan. It logged me out, rebooted, showed a progress screen of the percentage of files that had been scanned and then.....went to the login screen.

Did the offline scan work? Was it successful? Did it find any problems? I have no idea. I've done multiple searches to try to determine whether the scan found anything amiss and have come up empty. The offline scan doesn't seem to leave any trace.

  • For Scan options I see "Last Scan: Not Available"
  • For Protection History it says "No recent actions"
  • If I go to the Event Viewer I see at most an even 1000 and 1001 (scan start and stop). Sometimes I don't even see those Events in the Event Viewer

So did the Offline Scan work? Is no news good news? When I run an online scan I see a result screen and I'd feel better if there was someway I could verify that the offline scan ran and didn't find anything amiss.

Windows for home | Windows 11 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

  1. Ramesh 176.1K Reputation points Volunteer Moderator
    2025-02-16T04:58:58+00:00

    //So did the Offline Scan work? Is no news good news?//

    That's correct. If there is no news, it's good news. If the offline scan finds anything, it will show up in the threat history in Windows Security and in the msssWrapper log. Otherwise, nothing shows up in Windows Security; not even the timestamp of the last offline scan.

    Additionally, you can check the log file created by the Defender Offline scan.

    C:\Windows\Microsoft Antimalware\Support\msssWrapper.log

    If it says, "Offline scan completed with 0x00000000", then the scan was completed successfully.

    Detections, if any, will be recorded in that log.

    Ref https://www.winhelponline.com/blog/defender-offline-scan-stop-91-percent/

    9 people found this answer helpful.
    0 comments

7 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2025-02-16T22:39:56+00:00

    @Ramesh Srinivasan

    Thank you.

    The link to WinHelpOnline was especially helpful, since the example there had the same messages as I saw (including the Error msg so I knew not to be concerned that something had gone wrong.

    I did indeed get the

    Offline scan completed with 0x0000000

    so I guess that everything is good.

    1 person found this answer helpful.
    0 comments
  2. Anonymous
    2025-02-16T03:03:54+00:00

    I was able to run the PowerShell and the "Get-MpThreatDetection" command. It comes back empty (just the command prompt).

    Results seem to be as follows:

    If I run a scan (Full scan) it takes about 15 - 20 minutes and results are shown under Scan Options. This includes how many threats were found (almost always 0 threats so far).

    If I run an Offline Scan then the results that are shown under scan options are the last online scan run.

    When I run the "Get-MpThreatDetection" command I get the command prompt after a few seconds.

    When I look at "Protection History" all I see is "No recent actions"

    I don't feel like I have a good indication if the offline scan found anything or not. So I'm still just very stumped.

    Any other thoughts on how I might confirm whether anything was found with the offline scan?

    0 comments
  3. Anonymous
    2025-02-15T03:54:55+00:00

    Thanks for the reply. Sorry it's taken a while to get back to you.

    The second (how to run the offline scan) and third (view security protection history) links didn't help. I may not have been clear but I already ran the offline scan so I knew the steps in that link. And so far when I look at the protection history I see nothing after the offline scan. After an online scan I do see some results.

    I've also looked at the first link but I confess I am not sure how much I understand it and I haven't had the time to just blindly follow the steps and see what I find. I will let you know when I do try it out.

    0 comments
  4. Anonymous
    2025-02-12T08:01:13+00:00

    One or more of these links may be useful:

    Administrative Powershell PS:

    Get-MpThreatDetection

    Gets active and past malware threats that Windows Defender detected.

    https://learn.microsoft.com/en-us/powershell/module/defender/get-mpthreatdetection?view=windowsserver2025-ps

    Run Microsoft Defender Offline Scan in Windows 11 | Windows 11 Forum

    View Windows Security Protection History in Windows 11 | Windows 11 Forum

    0 comments