Windows Defender Scan Stuck or Repeating in Windows 11
A full scan can stay on one file count for a long time without being frozen, especially with archives, virtual disks, or a slow drive. Before resetting Defender, record the scan type, elapsed time, item count, and whether CPU or disk activity continues.
Check protection state first
Open an elevated PowerShell window and run:
Get-MpComputerStatus | Select-Object AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated, QuickScanAge, FullScanAge
Get-MpThreatDetection | Select-Object -First 10 InitialDetectionTime, ThreatName, ActionSuccess
Also check Windows Security > Virus & threat protection > Protection history. Do not delete scan history simply to make the symptom disappear; it may contain the evidence needed to identify a repeated detection or failed action.
Isolate the trigger
- Install pending Windows and security-intelligence updates, then restart.
- Run a Quick scan. If it completes, the engine is functioning and the full scan may be encountering a specific path or storage issue.
- Note whether a third-party antivirus is installed. Two active real-time engines can conflict.
- Check free disk space and storage health if the scan repeatedly stalls at similar points.
Use Microsoft Defender Offline only when the threat evidence or Microsoft guidance supports it; the offline scan restarts the computer and should not be presented as a generic first step.
Avoid risky reset loops
Do not repeatedly remove definitions, clear protection history, disable real-time protection, or force-stop security services. If definitions appear stale, use Windows Update or Defender's supported update path and verify that the signature timestamp advances.
Verify the result
Repeat the same scan type and confirm it completes, protection remains enabled, definitions are current, and Protection history does not show an unresolved action. If it stalls again, preserve the timestamp and event evidence for the next diagnosis rather than restarting the same repair loop.
How Againly helps
Againly can compare Defender service, signature, scan, update, and storage evidence and propose a safe next step. Security protections remain enabled unless a clearly explained, user-approved action requires otherwise.
[CTA: Try free diagnosis]