Schedule a Virus Scan in Windows 11 and 10 the Right Way

You can schedule a virus scan in Windows 11 and Windows 10 by opening Task Scheduler → Task Scheduler Library → Microsoft → Windows → Windows Defender, double-clicking Windows Defender Scheduled Scan, and adding a trigger on the Triggers tab. But before you do: Microsoft Defender already runs a scheduled scan of its own, plus always-on real-time protection that checks files as they are opened. For most home PCs a second, hand-built schedule adds almost nothing — and a full scan pinned to a bad hour on a laptop is a genuine annoyance for no security gain. Microsoft's own guidance is a daily quick scan, and it says plainly that it does not generally recommend scheduling full scans at all.

Jake scheduled a scan, and it cost him a customer

Jake read that a serious shop runs a weekly full virus scan, so he set one on the counter laptop — stock, card payments, part numbers. Friday, 2 p.m. It felt responsible.

The following Friday a woman came in wanting a screen replacement on a phone he had two of in the back. The laptop was crawling; stock lookup took ninety seconds. She said she would come back, and did not. Roughly $110 of margin gone, because a full scan was reading every file on the disk during his busiest hour.

"It found nothing, by the way," he told Ethan. "Four times in a row. So either I'm very clean or the whole thing is theater."

Ethan put his coffee down. "Ask me what was protecting that laptop the other six days and twenty-three hours of the week."

"...nothing?"

"Everything. Real-time protection was checking every file the moment it was opened, written or downloaded, all week. That is the part that keeps things off the machine. Your Friday scan was looking for something that had already been given six days to run."

The Task Scheduler route is below in full, and there are real cases where you should use it. But it is the small part of the picture, and knowing which part is which saves an afternoon and, in Jake's case, a customer.

What is already running, whether you schedule anything or not

On a normal Windows 11 or Windows 10 machine with no third-party antivirus, three things are already working. Most guides on this topic mention none of them.

Real-time protection is the part that actually stops things

Defender inspects a file at the moment it matters: when it is written to disk, opened, closed, or when you browse into the folder containing it. A malicious download is checked as it lands, not next Tuesday.

"Two more things do the heavy lifting and nobody names them," Ethan said. "Cloud-delivered protection sends a fingerprint of a suspicious file to Microsoft and gets an answer in under a second, so you're not stuck with whatever definitions arrived this morning. And behavior monitoring watches what a program does rather than what it is — a document that starts encrypting your files gets caught on the behavior, even if nobody has seen that file before."

So the scheduled scan is a supporting act. If you ever switched real-time protection off "just for an install" and forgot to switch it back, check it — our note on turning real-time protection on and off covers where the toggle lives.

There is already a scheduled scan, and Windows made it for you

Look in the Windows Defender folder in Task Scheduler and you will find four tasks already there:

• Windows Defender Scheduled Scan — the one everybody edits
• Windows Defender Cache Maintenance
• Windows Defender Cleanup
• Windows Defender Verification

Out of the box it is a quick scan, every day, aimed at 2:00 AM local time — except Defender adds a default two-hour offset and up to half an hour of randomization, so it fires nearer 4 a.m. It also waits for the machine to be idle first.

Those tasks are protected: delete or disable them and Windows puts them back at the next reboot. To stop the scheduled scan you change Defender's settings, not the tasks — more on that below.

Microsoft itself says do not schedule full scans

Almost nobody writing about this passes the line on. Microsoft's own Defender documentation states that a quick scan is the recommended option for scheduled scans, and that because of the time and resources involved, it generally does not recommend scheduling full scans.

Jake did not take that well. "Four years. Every week. And the people who make it say don't?"

"Near enough. Quick scan is what they recommend for a schedule, and they say outright they don't generally recommend scheduling full ones."

"Then why does every guide I've ever read tell me to?"

"Because those guides were written when it was better advice, and nobody went back. So here's my opinion, plainly: a nightly full scan on a laptop is a bad idea. It reads every file on the disk, it runs for hours, and it uses the definitions that existed the moment it started — so if new intelligence lands mid-scan, that four-hour job is stale before it finishes. Meanwhile real-time protection has already checked those same files every time somebody opened one."

"So I paid four hours of slow laptop for nothing."

"For very little. It felt responsible. That's the trap, and it's why the advice outlived its usefulness."

Microsoft went further in April 2026, saying in public what its documentation had implied for years: for most people the built-in protection in Windows 11 is enough, with independent labs putting Defender's protection rate level with the paid products.

Quick, full, custom, offline: which one, and when

Four scan types, and choosing wrongly is what turned a sensible idea into Jake's Friday afternoon.

"But ‘full’ sounds more thorough," Jake said. "Why would I not want thorough?"

"Thorough isn't the same as useful. A quick scan already covers everywhere malware has to be in order to start — the registry keys and startup folders that make it run again after a reboot. A file nobody opens isn't doing anything to you, and the second somebody opens it, real-time protection reads it. Ranked honestly: full is the least useful of the four on a healthy machine, and custom is the most underrated. Everyone schedules the first and nobody builds the second."

To run a scan by hand right now instead, our walkthrough on scanning a PC with Windows Defender covers the buttons, and the right-click scan for a USB drive is the one Jake's shop uses ten times a day.

When building your own schedule genuinely earns its place

Four cases where the default is not fine.

The machine is off overnight. The big one, and invisible. The built-in scan targets the small hours and waits for idle. A desktop shut down at 6 p.m. is never awake at 4 a.m., missed scans are not caught up by default, and the machine can go weeks without a scheduled scan while its owner assumes one runs nightly. Moving the schedule to lunchtime fixes it in one line.

A shared or family PC. Several people, several download habits, at least one installing things because a video said to. A daily quick scan at a fixed time produces a record you can look at.

A shop or bench machine. Jake's counter laptop has other people's USB sticks and phone backups in it constantly. A daily custom scan of the folder where those files land beats a weekly full scan of the whole disk, and takes seconds instead of hours.

A machine that sat unused for months. Old definitions, no recent scans, missed updates. One full scan, once — then a quick scan schedule, and leave it alone.

Schedule a scan in Windows 11 with Task Scheduler

The route the 2016 version of this post described, working the same way today — the folder is even still called Windows Defender, years after the product was renamed to Microsoft Defender Antivirus. Here it is with the parts that get skipped.

Step 1: open Task Scheduler

Press Windows key + R for the Run box — the small dialog that launches a program by name — type taskschd.msc and press Enter. The .msc ending means a management console file, one of the older admin tools that never moved into Settings. Searching Start for Task Scheduler works too.

Step 2: find the scan task

In the left-hand tree, expand in this order:

The Windows folder is long and alphabetical, so scroll. Double-click Windows Defender Scheduled Scan in the middle pane to open its properties.

Step 3: add a trigger

Go to the Triggers tab and click New. A trigger is the answer to "when should this run". Choose On a schedule, pick Daily or Weekly, set the start time, click OK. Pick a time the machine is awake — obvious, and the commonest mistake on this page. If the laptop is closed at 11 p.m., a midnight scan will not happen and nothing will tell you it did not.

Step 4: the Conditions tab, which is where schedules go to die

Do not close the window yet. Open the Conditions tab.

"I never opened that tab in my life," Jake said.

"Nobody does, and it's why half the schedules on the internet have run twice since March. Three settings decide whether your scan happens at all — and every guide that skips this tab is selling you a schedule that doesn't run."

• Start the task only if the computer is idle for... — if ticked, and you are using the PC at the scheduled time, the scan waits, potentially indefinitely. Untick it for a predictable time.
• Start the task only if the computer is on AC power — sensible on a laptop and worth keeping for a full scan. Defender also refuses scheduled full scans on battery by default, and one interrupted by unplugging stops and is retried at the next scheduled time rather than resuming.
• Wake the computer to run this task — the fix for a machine that sleeps through everything. It really does wake the PC, fans and all, which is a poor idea for a laptop in a bag.

Click OK. You may be asked for your account password; that is expected when a task runs whether or not you are signed in.

The PowerShell route, which is one line and more reliable

Editing the task changes the task. PowerShell changes Defender's own preferences, a level deeper, and survives the task being reset — and since Windows repairs those tasks by itself, that matters more than it sounds.

Open PowerShell as administrator: right-click Start and choose Terminal (Admin) on Windows 11, or Windows PowerShell (Admin) on Windows 10. A daily quick scan at 1 p.m., running whether or not the machine is idle:

ScanScheduleOffset is the default two-hour delay Defender adds to your chosen time, so zero makes 1 p.m. mean 1 p.m. RandomizeScheduleTaskTimes is the half-hour of jitter, useful on a room full of virtual machines and pointless on one laptop. ScanOnlyIfIdleEnabled is the idle requirement, and turning it off is what makes the scan predictable.

If you insist on a weekly full scan, one line does that too:

Note the two separate time settings: ScanScheduleQuickScanTime governs quick scans, ScanScheduleTime governs full scans, and setting the wrong one is a quiet way to change nothing at all.

To see what is currently set, and to put it all back:

Write that reset line down before you experiment — it undoes everything, including changes you made months ago and have forgotten.

Scheduling one folder, which is the genuinely useful custom scan

Defender's own scheduler cannot target a folder, so you build your own task. Right-click Task Scheduler Library, choose Create Task, name it, set a daily trigger, and on the Actions tab add an action starting powershell.exe with these arguments:

Tick Run whether user is logged on or not and Run with highest privileges on the General tab. To test it, right-click the task and choose Run — if it works by hand but not on schedule, the problem is a condition, not the command.

How to check whether a scan actually ran

"A schedule you haven't verified is a belief, not a control," Ethan said. Three ways to check.

Windows Security, for the date

On Windows 11: Settings → Privacy & security → Windows Security → Virus & threat protection. On Windows 10: Settings → Update & Security → Windows Security → Virus & threat protection. Same app, different route, because Settings was reorganized in Windows 11.

Under Current threats is the date of the last scan and how many files it checked. Protection history lists what has been found, quarantined or allowed — worth glancing at monthly, and where offline scan results appear.

PowerShell, for exact times

If QuickScanEndTime is a fortnight old on a machine you believed was scanning nightly, you have found your problem in one line. An empty FullScanEndTime means a full scan has never run here, which on a healthy machine is not a fault. AntivirusSignatureLastUpdated is arguably the more important field: definitions more than a few days old point at a machine that is not getting updates, a bigger problem than any scan schedule — our post on checking your Defender version and definition date covers what to do about that.

Event Viewer, for the full record

Press Windows key + R, type eventvwr.msc, and go to Applications and Services Logs → Microsoft → Windows → Windows Defender → Operational. Three event IDs tell the story:

• 1000 — scan started. The details name the type, quick or full.
• 1001 — scan finished, with how long it took.
• 1002 — scan stopped early. On a laptop, usually a full scan meeting battery power.

1000 with no matching 1001 is a scan that keeps starting and being interrupted. Neither event means the task is not firing, which sends you back to the Conditions tab.

The skip that looks like a failure

"Before you decide it's broken," Ethan said, "Defender deliberately skips a scheduled quick scan if a qualifying one already ran in the last seven days — qualifying meaning it ran after the most recent intelligence update, real-time protection was never off in between, and the machine has rebooted since. It saves burning battery on work that would find nothing. It doesn't apply to scans you start yourself, or on employer-managed machines. So a gap in the log isn't automatically a fault."

Why "it found nothing" is not the same as "I am clean"

"Four scans, nothing found," Jake said. "That's good news, surely."

"It's information. It is not a certificate, and I'd rather you were slightly suspicious than falsely reassured. A clean result means one thing precisely: nothing on that machine matched what Defender knew about, at the moment it looked."

Four ordinary reasons a genuinely infected PC can report clean:

• It is too new. Malware written last week may not be in any definition set. Cloud protection and behavior monitoring close much of that gap — why they matter more than scan frequency — but nothing closes it completely.
• It loads before the scanner. Something that starts with Windows can hide from a scanner running inside Windows. The entire reason the offline scan exists.
• It is not malware in the technical sense. A browser extension harvesting what you type, a "PC cleaner" you installed on purpose, a remote-access tool a scammer talked you through — often not flagged, because you consented. The category that costs real people real money.
• The damage already happened. If a password was phished last month, the machine can be spotless and the account still compromised. A scanner cannot find what was never on the disk.

"So what do I tell a customer who wants a yes or no?"

"Judge the machine on behavior as well as on the scan. Slow, browser pages nobody opened, an unfamiliar program in startup, messages they didn't send — that deserves investigation whatever the scan says." Some of those symptoms come from a machine quietly enlisted into somebody else's network; our explainer on what a botnet is and why it makes a PC slow covers what that looks like from the user's side.

And the admission that belongs on every page like this: if a machine has been seriously compromised, no scan makes it trustworthy again. The honest path is a clean reinstall with data restored from a backup taken before the trouble started — which is why keeping a system image and a separate data backup is worth more than any scan schedule here.

When you actually suspect something: the offline scan

If you came here because something feels wrong rather than untidy, this is the section you needed.

Windows Security → Virus & threat protection → Scan options → Microsoft Defender Antivirus (offline scan) → Scan now.

The PC restarts, loads a minimal environment before Windows, and scans from there for around fifteen minutes. Save your work first — the restart is immediate and not optional. When it finishes the machine restarts again and the findings appear in Protection history.

"Anything that loads with Windows can interfere with a scanner running inside Windows," Ethan said. "A scan that runs before Windows starts takes that away. It's the most useful button in the whole app and almost nobody finds it." Our post on what Defender Offline is and how to launch it goes through it screen by screen.

Two caveats. It is a quick scan of the standard locations, not an exhaustive read of the disk. And if the machine will not start Windows at all, this is not your tool — starting in Safe Mode comes first.

Windows 10: the same steps, and one bigger question

Everything above works identically on Windows 10 22H2 — same tool, same path, same folder name, same tabs, same PowerShell commands. These steps are the same on both. The one difference is reaching Windows Security, under Settings → Update & Security rather than Privacy & security.

Then the bigger question. Windows 10 reached end of support on 14 October 2025. Defender still gets definition updates and still scans perfectly well, but Windows itself gets no security fixes unless the machine is enrolled in consumer Extended Security Updates — which Microsoft extended in June 2026, so enrolled devices are covered into October 2027. Enrollment is under Settings → Update & Security → Windows Update, needs a Microsoft account, and is free if you sync settings with Windows Backup, otherwise around $30 one-off.

"A perfectly scheduled scan on an unpatched operating system," Ethan said, "is a smoke alarm in a house with no fire door." If you are spending an evening on a Windows 10 machine's security, an hour of it is better spent checking whether it is eligible for Windows 11 or whether ESU is the sensible bridge.

If you have another antivirus installed

Install a third-party antivirus that registers itself properly and Defender steps back, turning off its own real-time protection so two scanners are not fighting over the same file. Scheduling a Defender scan there achieves little — schedule scans in whichever product is in charge. The middle option is limited periodic scanning, a deliberate switch in Windows Security that lets Defender run occasional second-opinion scans; our post on Defender running alongside another antivirus covers where it lives.

"And do I sell people antivirus?" Jake asked.

"Not for detection. On a supported Windows, with updates installing and backups happening, the built-in protection is enough — independent testing puts the detection rates within a hair of each other. Paid products earn their money on the extras: managed deployment, family controls, identity monitoring. Sell those if the customer needs them. Don't sell fear."

Turning a scheduled scan off, or putting everything back

If a scan keeps starting at an inconvenient moment, the instinct is to delete the task — which, as above, Windows simply undoes at the next reboot. Move the schedule instead:

Nine times out of ten the complaint is not "a scan runs" but "a full scan runs while I'm working", and the second line fixes that outright.

Questions people actually ask about this

Do I need to schedule a virus scan in Windows 11?

Usually not. Defender already runs always-on real-time protection plus its own scheduled scan task, which Windows repairs by itself. A second schedule mainly earns its place on a shared or family PC, a machine switched off overnight, or a shop bench machine.

Does Microsoft Defender already scan automatically?

Yes, in two ways people confuse. Real-time protection checks every file as it is opened, written or downloaded, and that is what stops an infection. Separately, Windows ships a scheduled scan task set to a daily quick scan in the small hours, when the machine is idle.

How do I schedule a Defender scan using Task Scheduler?

Open Task Scheduler, expand Task Scheduler Library, Microsoft, Windows, then the Windows Defender folder. Double-click Windows Defender Scheduled Scan, open the Triggers tab, click New, choose your day and time, and click OK. Then check the Conditions tab, because the idle and power settings there are why most hand-made schedules never fire.

What is the difference between a quick scan and a full scan?

A quick scan checks memory, running processes, registry startup locations, Windows startup folders and mounted removable drives, which is where malware must live to survive a reboot. It finishes in minutes. A full scan does all that and then reads every file on every fixed disk, which can take hours.

Should I schedule a full scan every week?

Microsoft's own documentation says it generally does not recommend scheduling full scans, given the time and resources involved. A quick scan plus always-on real-time protection is the recommended arrangement. If you want a full scan anyway, make it monthly, on mains power, at an hour the machine is awake and idle.

How do I schedule a scan with PowerShell instead?

Open PowerShell as administrator and use Set-MpPreference. It writes to Defender's own settings rather than editing a task, so it survives the task being reset. One line sets the day, the scan type and the start time, and another controls whether the scan waits for the machine to be idle.

Why did my scheduled scan not run last night?

Four common reasons. The machine was asleep or off, and missed scans are not caught up by default. The task was waiting for idle and the PC never was. It was a full scan and the laptop was on battery. Or Defender skipped it because a qualifying quick scan ran within the last seven days.

How do I check whether a scan actually ran?

Three ways. Windows Security shows the last scan date on the Virus and threat protection page, and Protection history lists what each scan did. PowerShell reports exact start and finish times. Event Viewer holds the full record, where 1000 means started, 1001 means finished and 1002 means stopped early.

My antivirus found nothing. Does that mean my PC is clean?

No, and this is the most important sentence on this page. A clean result means nothing matched the definitions and models in use at that moment. Brand new malware, something dormant in a file nobody opens, and anything that loads before Windows can all produce a clean report. Treat it as reassurance, not proof.

What is a Microsoft Defender offline scan and when should I use it?

It restarts the PC and scans from the Windows Recovery Environment, before Windows itself is running, so anything that loads with Windows cannot hide from it. Use it when you genuinely suspect an infection, when the same threat keeps coming back, or when odd behavior survives a reboot.

How long does a full scan take in Windows 11?

Anywhere from about twenty minutes to several hours, and it depends far more on how many files you have than on how fast the machine is. A fresh install on a small SSD finishes quickly; a drive full of photos and virtual machines can run for hours. A quick scan takes minutes.

Can I schedule a scan of one folder or a USB drive?

Yes, with a custom scan, and it is the one scheduled scan genuinely worth building by hand. Create your own task in Task Scheduler running a PowerShell command pointed at the folder you care about. It finishes in seconds rather than hours, so it can run daily without anybody noticing.

Do these steps work the same in Windows 10?

Yes. Task Scheduler is the same tool at the same path, the PowerShell commands are identical and the scan types are the same. The only difference is reaching Windows Security, because Settings was reorganized in Windows 11. Separately, Windows 10 reached end of support in October 2025, which matters more than any scan.

Do I still need Defender scans if I have another antivirus?

When another antivirus registers itself properly, Defender steps aside and stops its own real-time protection so two scanners are not fighting over the same file. Scheduling a Defender scan there achieves little. You can enable limited periodic scanning as a deliberate second opinion.

What Jake changed in the end

The Friday full scan is gone. In its place, one line of PowerShell: a daily quick scan at 1 p.m. with the idle requirement off, so it happens whether the counter is busy or not. Then a custom task he built by hand — a daily scan of the folder where customer files land when he pulls photos off a phone. Four seconds, aimed at the place risk actually arrives.

"So the useful scan is the tiny one," he said, "and the impressive one was the problem."

"Usually. The full scan feels like doing something. Real-time protection on, updates installing, a backup you could restore — that is doing something, and it takes ten minutes once. And when a customer swears their machine has a virus: offline scan, then look at what's actually happening. Not four hours of full scan while they wait."

Revision note. Originally published in December 2016, when Windows 10 was on the Anniversary Update and building your own schedule in Task Scheduler genuinely was the answer people needed. That route still works and is set out above in full, re-checked on 9 August 2026 against Windows 11 25H2 and Windows 10 22H2. What moved underneath it is Defender itself — real-time protection, cloud-delivered protection, behavior monitoring, and a scheduled scan task Windows creates and repairs on its own — and Microsoft's guidance moved with it, to a daily quick scan and an explicit recommendation against scheduling full scans. So this version leads with what is already protecting the machine, gives the schedule properly for the cases where it earns its place, and adds what 2016 had no reason to cover: confirming a scan really ran, why a clean result is not proof, and where the offline scan lives. If your machine behaves differently — a scan that will not fire, a schedule that resets, or something you are simply unsure about — please do write in through the contact page. We would rather hear about it and check than have you worrying about a PC on your own.