Microsoft Defender Offline Scan

zbook said:

Nice.

Could not have done it without people like you and OldNavyGuy.

I just want to take a moment and try to absorb how it is that the Guru's and virtually all the folks on here who know so much more it seems than the actual Microsoft employees that develop this evolving OS.

I really believe that if it weren't for this site, a lot more businesses would be shutting down because they simply just couldn't get their computers to perform the daily business tasks.

This site, without a doubt, deserves the ultimate respect from Microsoft. Sure a lot of us give them a hard time (myself included) and point the finger of blame towards their development team when it is sometimes our fault.

In this particular case, it was my fault (I'm man enough to admit it) but I still stand by what I said as far as Microsoft being responsible for a lot of businesses losing productivity because they have to stop everything they are doing and fix a sometimes crippled OS due to inept testing before release through the regular Windows Update channel.

I can't even begin to explain how many times I have walked into a business within the last two years alone (actually since the induction of Windows 10 release) and they told me their computers were down due to a crippled or inoperable/unstable OS and could not pull up product information on their inventory to even tell me if a bulk purchase of so many units was available.

This is 2020, and if a business can't pull up their inventory specs at any given moment (especially large warehouse sale outlets), they lose sales due to not being able to give customers an actual projection model fulfillment agreement.

At any rate, this site makes using Windows 10 a little more bearable and its members are the ones that should be getting paid for finding the workarounds until Microsoft actually gets around to fixing the problems.

Well........ as usual, I've typed too much and if I get on a rant, I'll end up typing something I'll regret again.

So a simple Thank You to TenForums and its members should be where I leave this before I start stoking another fire I can't put out!

EyeInTheSky said:

I mean who the heck would of ever thought that a Recovery Partition would have anything to do with an Offline Scan in an Online world?

A special thanks to OldNavyGuy for his suggestion that a Windows Recovery Partition being deleted was the problem.

The same thing happened to me...because I deleted the Recovery Partition on one of our systems.

That also broke Reset this PC in Settings > Update & Security > Recovery

I tricked myself into thinking that the space was up for grabs -



Uh...no -

(Note: MiniTool Partition Wizard calls Disk Management "Disk 0" - "Disk 1")

Hello all,

I discovered having this WDO issue also, today, and had almost given up trying to find a solution when I came across this thread. Ultimately my root cause was slightly different [more of that below] but you guys put me on the right track, so first and foremost I just wanted to thank you all for the excellent info provided herein.

I recently cloned the entire HDD on my desktp PC onto SSD, using MiniTool Partition Wizard [11.5] having done exactly the same previously and successfull for my laptop. However, it would appear that it was a mistake to leave the original HDD in situ, despite trying "hiding" it in BIOS. And altho W10 assigned no drive letters to the "hidden" HDD, the Disk Managment Tool, as expected, easilly showed both HDD and SDD as present, complete with their respective Recovery Partitions.

Exploring each Rec Part with MPW I determined that the original HDD had contents exactly as exampled by OldNavyGuy above. The current SDD was differnt by two additional, recent entries (...IndexTool... and WPsettings, or such like - not on that PC at present) so suggesting, to me, that the SDD Rec Part has been actively accessed since cloning.

On an absolute whim, I diconnected the old HDD entirely... And hey presto - WDO started working!!!

So now I have a related question, if you'll forgive the slight drift off topic...

What exactly is the Rec Part any good for (apart from WDO!) these days ???

I cant find a way to boot into it (e.g. the common advice of reboot with F8 doesnt work on either of my W10 machines), and all the articles I've read so far suggest that it is pretty much redunant technology and far better to fix/recover OS issues using Windows Media Creator (which does make some kind of sense to me, especially if its a machione thats been in service a long time since installing).

Any comments, feedback, info, enlightenment etc gratefully accepted.

Many thanks,

Loo

Loo said:

What exactly is the Rec Part any good for (apart from WDO!) these days ???

Hello Loo and Welcome to TenForums

OldNavyGuy also mentioned that it broke "Reset this PC" in: Settings > Update & Security > Recovery

A lot of people mentioned using the "Reset this PC" as a quick alternative to the other methods of fixing common problematic computer troubles.

Like you, I have found no scenario where I needed to directly rely on the Recovery Partition (except for this thread), and as far as booting into it, I have no idea either.

The Factory Recovery Partition was so old on my computer that I thought I was going to have to fetch a wheelchair for it; but again, the redundancy of that partition would be similar to going back to floppy disks.

Hello EyeInTheSky,

Thank you for replying and your welcome message!

OldNavyGuy also mentioned that it broke "Reset this PC" in: Settings > Update & Security > Recovery

A lot of people mentioned using the "Reset this PC" as a quick alternative to the other methods of fixing common problematic computer troubles.

I've seen this method mentioned elsewhere around the web but "Reset this PC" has always seemed too drastic for anything I've ever needed to do/fix, so never tried it. But I don't doubt OldNavyGuys' comments/observations!

Like you, I have found no scenario where I needed to directly rely on the Recovery Partition (except for this thread), and as far as booting into it, I have no idea either.

Its reassuring to hear that from you (I havn't gone completely mad!), albeit a tad disappointing, perhaps, as I remember a Win7 time when it was still perfectly possible to create a fully functional, if somewhat basic, stand-alone recovery utility in a <500M USB stick.

The Factory Recovery Partition was so old on my computer that I thought I was going to have to fetch a wheelchair for it; but again, the redundancy of that partition would be similar to going back to floppy disks.

Interesting you should touch on this! Since my first post I've explored my machines (I have a laptop and a desktop) further and note that the they all have at least one entry dated within the last 2 weeks. So clearly Win10 still has recourse to access the Rec Part under certain circumstances... But of course, this could simply be legacy behaviour that MS have yet to "tidy up".

In any event, I've never bothered to delete any of my recovery partitions as the space lost to them has never seemed worthwhile recovering in light of modern, large storage drives,


On a note more in keeping with your original content; You appear to be, or have been, a regular user of WDO - why is that?

When I finally got my WDO to run, I found it quite uninformative! The initial screen told me very little beyond its basic progress, with no findings reported upon completion, just simply booting into Win10 proper. Moreover, I couldn't find any generated report anywhere - did I miss something?

Cheers,

Loo

Loo said:

On a note more in keeping with your original content; You appear to be, or have been, a regular user of WDO - why is that?

Windows Defender Offline has the ability to scan files that can't be accessed under a normal booted operating environment. In other words, if you are booted up and running, I guess there are files that cannot be scanned while in use.

For the record, I am not a regular user of Windows Defender Offline, as I run it maybe twice a year or if my computer is exhibiting odd behavior that cannot be explained such as redirects when clicking on certain programs or a simple file or document that will not open or opens something else entirely unrelated to the click.

I visit maybe four sites total. This forum, another hobby forum, my banking and eBay. So there are none of those girl sites that I have to worry about placing unwanted material on my computer if that is why you asked: "why is that?"

Loo said:

When I finally got my WDO to run, I found it quite uninformative! The initial screen told me very little beyond its basic progress, with no findings reported upon completion, just simply booting into Win10 proper. Moreover, I couldn't find any generated report anywhere - did I miss something?

There will be a report if it did find something and you would just open "Windows Security" and click on Virus & Threat Protection and then click on Protection History.

Otherwise, no; it will just do as you pointed out and boot into the OS and maybe a notification pop-up will occur depending on your "Notification Settings" and inform you that a threat was detected in the Offline environment. I've never had one, so I am unsure if after the Offline Scan is done, a direct message will be displayed or not.

Hi again,

You said...

Windows Defender Offline has the ability to scan files that can't be accessed under a normal booted operating environment. In other words, if you are booted up and running, I guess there are files that cannot be scanned while in use.

I understand and completely agree with the value of performing offline virus/malware scanning. I think my primary AV will also do this but its not that straight forward. Besides, a secondary AV tool (e.g. Defender) offers the possibility of improved detection likelihood.

I visit maybe four sites total. This forum, another hobby forum, my banking and eBay. So there are none of those girl sites that I have to worry about placing unwanted material on my computer if that is why you asked: "why is that?"

I meant nothing untoward by my comments, I simply wondered whether your apparent enthusiasm for WDO was from the knowldege of something really clever it is able to do.

There will be a report if it did find something and you would just open "Windows Security" and click on Virus & Threat Protection and then click on Protection History.

I did check the Protection History screen but all it displayed was the same thing it had done after a previous Quick Scan that actually found something earlier the same day. Personally, I would prefer to see a seperate WDO report stating clearly that it did, or did not, find anything (perhaps it exists and I simply dont know how to find it yet).



All in all, this has been an interesting delve into the vaguaries of Win 10's WDO (and Recovery Partitions!), albeit with a somewhat uninspiring outcome, in my usage experience thus far. Perhaps it will yield something more positive for me at a later date.

Thanks again for your participation and time.

Cheers for now,

Loo