How to Run a Windows Defender Offline Scan in Batch Script

@echo off
setlocal

echo ============================================================
echo   Microsoft Defender Offline Scan Trigger
echo ============================================================

:: Check for admin rights first
net session >nul 2>&1
if %errorlevel% neq 0 (
    echo [ERROR] Administrator privileges are required.
    echo [HELP] Right-click and select 'Run as administrator'.
    pause
    exit /b 1
)

echo [WARNING] This will restart your computer immediately.
echo [WARNING] Save all open work before proceeding.
echo.
set /p "CONFIRM=Proceed with offline scan? (Y/N): "
if /i not "%CONFIRM%"=="Y" (
    echo [INFO] Cancelled by user.
    pause
    exit /b 0
)

echo.
echo [PROCESS] Preparing the offline environment...

:: Trigger the scan
powershell -NoProfile -Command "Start-MpWDOScan" 2>nul

if %errorlevel% neq 0 (
    echo [ERROR] Failed to start offline scan. Code: %errorlevel%
    echo [HELP] Ensure Windows Defender is active and not replaced
    echo        by a third-party antivirus.
    pause
)

@echo off
setlocal

:: Check for admin rights
net session >nul 2>&1
if %errorlevel% neq 0 (
    echo [ERROR] Administrator privileges are required.
    pause
    exit /b 1
)

:: Locate MpCmdRun.exe
set "MP_PATH="
if exist "%ProgramFiles%\Windows Defender\MpCmdRun.exe" (
    set "MP_PATH=%ProgramFiles%\Windows Defender\MpCmdRun.exe"
) else (
    for /f "delims=" %%f in ('dir /s /b "%ProgramData%\Microsoft\Windows Defender\Platform\MpCmdRun.exe" 2^>nul') do set "MP_PATH=%%f"
)

if not defined MP_PATH (
    echo [ERROR] Could not locate MpCmdRun.exe.
    pause
    exit /b 1
)

echo [WARNING] This will restart your computer for an offline scan.
echo.
set /p "CONFIRM=Proceed? (Y/N): "
if /i not "%CONFIRM%"=="Y" (
    echo [INFO] Cancelled by user.
    pause
    exit /b 0
)

echo [PROCESS] Scheduling offline scan...

"%MP_PATH%" -Scan -ScanType 4

if %errorlevel% equ 0 (
    echo [SUCCESS] Offline scan scheduled. Your computer will restart shortly.
) else (
    echo [ERROR] Failed to schedule offline scan. Code: %errorlevel%
)
pause

@echo off
setlocal

echo ============================================================
echo   CRITICAL SECURITY CLEANUP TOOL
echo ============================================================
echo.
echo This tool triggers a Windows Defender Offline Scan to remove
echo deep-seated infections like rootkits and boot-level malware.
echo.
echo IMPORTANT:
echo   [1] Save all open work. The computer WILL restart.
echo   [2] The scan takes approximately 15-30 minutes.
echo   [3] Have your BitLocker Recovery Key ready if applicable.
echo.

:: Verify Admin Rights first
net session >nul 2>&1
if %errorlevel% neq 0 (
    echo [ERROR] You MUST run this as an Administrator.
    pause
    exit /b 1
)

set /p "CONFIRM=Are you ready to proceed? (Y/N): "

if /i not "%CONFIRM%"=="Y" (
    echo [EXIT] Operation cancelled by user.
    pause
    exit /b 0
)

:: Locate MpCmdRun.exe
set "MP_PATH="
if exist "%ProgramFiles%\Windows Defender\MpCmdRun.exe" (
    set "MP_PATH=%ProgramFiles%\Windows Defender\MpCmdRun.exe"
) else (
    for /f "delims=" %%f in ('dir /s /b "%ProgramData%\Microsoft\Windows Defender\Platform\MpCmdRun.exe" 2^>nul') do set "MP_PATH=%%f"
)

:: Update definitions before the scan
if defined MP_PATH (
    echo.
    echo [STEP 1] Updating virus definitions...
    "%MP_PATH%" -SignatureUpdate >nul 2>&1
    if %errorlevel% equ 0 (
        echo   [PASS] Definitions updated.
    ) else (
        echo   [WARN] Could not update definitions. Proceeding with current signatures.
    )
) else (
    echo [WARN] MpCmdRun.exe not found. Skipping definition update.
)

:: Trigger the offline scan
echo.
echo [STEP 2] Initiating Offline Scan...
powershell -NoProfile -Command "Start-MpWDOScan" 2>nul

if %errorlevel% neq 0 (
    echo [ERROR] Failed to initiate offline scan. Code: %errorlevel%
    echo [HELP] Try using Windows Security GUI instead:
    echo        Settings ^> Windows Security ^> Virus ^& threat protection
    echo        ^> Scan options ^> Microsoft Defender Offline scan
    pause
    exit /b 1
)

echo.
echo [INFO] Your computer should restart momentarily...
echo ============================================================