Microsoft Defender Offline: meaning of RtpPluginStop and why later successful scans show a different pre-reboot pattern

Hello,

I am trying to understand the internal behavior of Microsoft Defender Offline on Windows 11.

System state:

• Microsoft Defender Antivirus is the primary AV
• WinRE is enabled
• Secure Boot and TPM are enabled
• Defender platform: 4.18.26070.9
• Defender engine: 1.1.26080.2

On one successful Microsoft Defender Offline run, the Defender Operational log showed this sequence:

07:37:04

Event 2030:

Microsoft Defender Antivirus downloaded and configured Microsoft Defender Antivirus (offline scan) to run on the next reboot.

07:37:04

OfflineScanBootConfig:

0x0 -> 0x1

07:37:04

OfflineScanRun was created.

07:37:12

Diagnostics\CleanupComponentProgress:

CleanupCompleted -> RtpPluginStop

The System log also shows that at 07:37:04 MsMpEng.exe itself initiated the restart on behalf of SYSTEM:

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0\MsMpEng.exe

After that, Windows entered its normal shutdown sequence, and RtpPluginStop was logged during that shutdown.

In other words, RtpPluginStop was logged approximately 8 seconds after Defender configured the Offline Scan and initiated the restart.

However, on several later successful Defender Offline runs, the pre-reboot pattern was different.

For example:

Event 2030

OfflineScanBootConfig: 0x0 -> 0x1

Then the machine rebooted and Defender Offline ran successfully, but there was:

• no RtpPluginStop
• no Event 5001
• no indication in the Defender Operational log that Real-time Protection was formally disabled

After returning to Windows, all of these successful runs showed the expected sequence:

ServiceStartStates: 0 -> 1

PostPlatformUpdate -> LoadingEngine

LoadingEngine -> ServiceStartedSuccessfully

OfflineScanBootConfig: 0x1 -> 0x0

ServiceStartStates: 1 -> 0

So the main questions are:

1. What exactly does: Diagnostics\CleanupComponentProgress = RtpPluginStop mean internally?
2. Does RtpPluginStop mean that Real-time Protection itself was disabled, or only that an RTP-related plugin/component was stopped as part of cleanup/shutdown?
3. If Real-time Protection had actually been disabled, should Event 5001 normally be logged?
4. Why would one successful Defender Offline run log RtpPluginStop while several later successful Offline runs do not?
5. Could this be related to the first Defender Offline run after a Defender platform initialization/update, or to a one-time cleanup state?
6. Is this difference in the pre-reboot sequence considered normal/state-dependent behavior?

Separately, some Defender Offline attempts intermittently fail before reboot with:

Event 2031

HRESULT 0x8000000A

"The data necessary to complete this operation is not yet available."

Later attempts can succeed without any other system change.

I am mainly looking for clarification of the internal meaning of RtpPluginStop and whether the differing successful-run patterns are expected.