Windows offline scanner

Question

Windows offline scanner is not running. It order to get it to run I have to reinstall windows. Once that is done it runs for a short amount of time but eventually stops running again. Not sure how to repair. I would hope to have to reinstall windows every time it stops working

Answer 1

Check and re-enable Windows Recovery Environment (WinRE), because Microsoft Defender Offline cannot run when WinRE is disabled and may fail without displaying an error.^1^

1. Check WinRE

1. Right-click Start, select Terminal (Admin), and approve the administrator prompt.
2. Run:

reagentc /info

3. Find Windows RE status:
   • If it says Disabled, run:

reagentc /enable
reagentc /info

The second command should now report Windows RE status: Enabled.

• If it says Enabled, skip to the next section.
• If /enable reports that the Windows RE image was not found or cannot update the boot configuration, WinRE itself needs repair; repeatedly reinstalling Windows is not the appropriate routine workaround.

2. Update Defender and retry from PowerShell

Defender Offline also requires:

• An administrator account.
• Microsoft Defender Antivirus operating as the primary antivirus, rather than passive mode.
• Current Defender platform, engine, and security-intelligence updates.^1^

Run Windows Update, including available Microsoft Defender updates. Then save all work and close applications.

If BitLocker protects the system drive, have the recovery key available; Microsoft recommends suspending BitLocker before the offline scan to avoid a recovery-key prompt.^1^

Open PowerShell as administrator and run:

Start-MpWDOScan

The computer should restart into the isolated Defender environment, perform the scan, and then return to Windows. The documented scan time is approximately 15 minutes, although actual time can vary.^1^

You can also start it from:

Windows Security → Virus & threat protection → Scan options → Microsoft Defender Offline scan → Scan now

3. If WinRE is enabled but the scan still does not start

Check whether the required Defender services and drivers are functioning. In PowerShell (Admin), run:^2^

Get-Service WinDefend, WdBoot, WdFilter, WdNisSvc, WdNisDrv,
SecurityHealthService, wscsvc |
Format-Table -Auto DisplayName, Name, StartType, Status

Expected key results include:

• WinDefend: Running
• WdFilter: Running
• SecurityHealthService: Running
• wscsvc: Running
• WdBoot: normally Stopped after Windows has booted

If a non-Microsoft antivirus is installed, Defender may not be the primary antivirus. Uninstall that antivirus only if you intend to return Defender to primary protection, restart Windows, update Defender, and retry.^2^

4. Repair Defender’s platform and definitions

Use this only when WinRE is enabled but Defender services, updates, or scans are failing. These commands remove the current security-intelligence definitions and reset the Defender platform; Windows must download fresh updates afterward.

Open Command Prompt as administrator, change to the newest Defender platform folder under:

C:\ProgramData\Microsoft\Windows Defender\Platform

Then run:

MpCmdRun.exe -RemoveDefinitions -All
MpCmdRun.exe -ResetPlatform
MpCmdRun.exe -SignatureUpdate -MMPC

Restart Windows, run Windows Update, and retry Start-MpWDOScan. This is Microsoft’s documented Defender repair sequence for service/platform problems.^2^

Avoid deleting Defender policy registry keys unless the computer is unmanaged and a policy problem has actually been identified; those settings may be intentionally controlled by an organization.

5. If the failure returns again

Because Windows has already been reinstalled and the problem later recurs, capture the exact failure rather than reinstalling again:

1. Press Windows key + F immediately after the failed attempt.
2. In Feedback Hub, report it under Security, Privacy, and Accounts → Windows Defender Antivirus.
3. Include whether the PC restarted, whether the offline interface appeared, the output of reagentc /info, and any Defender errors.

Microsoft recommends Feedback Hub for recurring Defender scan errors, followed by Windows Update and current protection updates.^3^

---

References

1. Run and review the results of a Microsoft Defender Offline scan
2. Troubleshoot Microsoft Defender Antivirus service startup problems
3. Troubleshoot problems with detecting and removing malware | Microsoft Support