Windows defender never finishes full scan and offline scan

Question

Windows defender never finishes full scan and offline scan

Transcend 0

When running a full scan, my windows defender always stuck at 80% or nearly 2 hour after i start scanning. While running offline scan will give me a fail error message after finishing the scan and prompt me to restart the PC. Quick scan works fine though.

0 comments

2 answers

Your answer

Answer 1

A full scan can legitimately take a long time, especially on large disks or when scanning large archive files such as ZIP files. If it consistently stalls around 80% and the offline scan ends with a failure message, use this path:

Free up disk space, especially on the system drive. Microsoft Defender Antivirus needs available disk space to remove and quarantine malware. Low space can prevent a scan from completing.
Restart the PC, then run the scan before opening other apps. Scanning uses CPU and memory. Closing non-essential apps can reduce contention and help the scan finish.
Check whether the device restarted or hit a power-related interruption during the scan. In Event Viewer, review:
- System log for Event IDs 6005, 6006, 6007, 6008
- Kernel-Power events such as 107, 42, 507, 506, 105 These can explain scans that stop before completion.
If the full scan was started by command line or as a scheduled scan, check for timeout behavior.
- Scheduled Full Scans or MpCmdRun full scans have a seven day limit.
- Scheduled Quick Scans or MpCmdRun quick scans have a one day limit.
- Scans started from the Windows Security app or the Microsoft Defender portal do not use MpCmdRun and have no time limit.
For the offline scan failure, verify the prerequisites. Microsoft Defender Offline requires:
- Microsoft Defender Antivirus to be the primary antivirus and not in passive mode
- Current platform, engine, and security intelligence updates
- A signed-in user with local administrator privileges
- Windows Recovery Environment (WinRE) enabled
Check WinRE status. Run:
```
   reagentc /info
```
If WinRE is disabled, the offline scan does not run and no error message is displayed. Enable it with:
```
   reagentc /enable
```
Risk: enabling WinRE changes recovery configuration. Use only in an elevated command prompt.
Confirm whether the offline scan was actually scheduled. In Event Viewer, go to Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational and look for:
- Event ID 2030 on newer Windows 10/11 builds
- Event ID 5007 on older versions
After the offline scan, review the result in: Start > Settings > Update & Security > Windows Security > Virus & threat protection > Scan options > Protection history

If the PC freezes or hangs during full scans, also make sure apps are updated and Defender definitions are current. If malware appears to keep returning, running Microsoft Defender Offline is the recommended method because it scans outside Windows.

References:

Answer 2

Dear @Transcend

Since Quick Scan completes successfully, while Full Scan consistently remains around 80%, I would first determine whether the scan is actually stuck or simply taking a long time to process a particular file or location. Full Scans can take considerably longer on systems with large disks, many files, or large archive files. The percentage displayed by Windows Security is also not necessarily a linear indication of the remaining scan time.

Before running the scan again, make sure Windows and Microsoft Defender are fully up to date and that the system drive has sufficient free space. I would also restart the PC and run the Full Scan before opening other applications, just to rule out resource contention.

For the Offline Scan failure, I would check the Windows Recovery Environment (WinRE), as Microsoft Defender Offline relies on it. From an elevated Command Prompt, run:

reagentc /info

Make sure Windows RE status is Enabled. If it is disabled, enable it with:

reagentc /enable

Restart the device afterwards and try the Offline Scan again.

It would also be useful to check Event Viewer > Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational immediately after reproducing the issue. Look for errors or warnings corresponding to the time when the Full Scan stops or the Offline Scan fails. Depending on the Windows version, events related to the Offline Scan request may include Event ID 2030 or, on older builds, Event ID 5007.

If the Full Scan continues to stop at approximately the same point, you can also test it directly through MpCmdRun.exe from an elevated Command Prompt:

"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 2

This is useful for determining whether the behavior is specific to the Windows Security interface or whether the Defender scanning engine is encountering the same condition.

If the machine is actually freezing, restarting, or shutting down during the scan rather than simply remaining at 80%, I would additionally check the System event log for unexpected shutdown or power-related events.

The most useful next information would be the exact error shown by Microsoft Defender Offline, along with the Windows version/build and Microsoft Defender platform version. With those details, it should be possible to narrow down whether this is related to WinRE, the Defender engine, or a specific file/location being processed during the Full Scan.