You might wonder if Windows Defender can store log files of the offline scan. Well, as far as we know, the popular anti-virus and malware scanner does not do such a thing, but there is something else if you want to gain access to valuable data. Now, if you really want to see the results of the offline scan, we can help with that, no problem and at no cost.
It‘s probably not possible to download the data, but at least you can view it and then decide what to do with the information.
How to see Windows Defender Offline scan results
If you are looking to view the Windows Defender Offline scan results or log, then this information should help a great deal in your quest.
1] Look in the Support folder
One of the easiest ways to locate the log file for Windows Defender is to navigate to the following location and snoop around-
C:\ProgramData\Microsoft\Windows Defender\Support
That’s the easiest way, but it doesn’t show everything you might need, so we will discuss other ways.
2] Check Event log
You might know this, but several things are shown in the Event Log, including data from Windows Defender offline scan. To get to that section, we suggest firing up the search box, then copying and pasting the following command and hitting the Enter key.
%windir%\System32\winevt\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx
That should deliver some more needed information, at least, so go on ahead and navigate there when ready.
Alternatively, you could right-click on the Start button, and from there, select Event Viewer.
Then go to:
Event Viewer > Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational.
After doing all of that, the user should now see the following:
- Windows Defender scan has started. (Event ID 1000)
- Windows Defender scan has finished. (Event ID 1001)
- Windows Defender signature version has been updated. (2000)
Here, you can check the logs.
Read: Log files created when you upgrade Windows
3] Find Defender scan results
OK, so when it comes down to scan results, things might get a little bit tricky, but not impossible. What you’ll want to do is right-click on the Start button again, then select Settings > Update & Security > Windows Security > Virus & threat protection.
From this section under Virus & threat protection, the user should select any of the Threat History options, and that’s it basically.
The logs are usually used by system admins or to submit errors or problems with Windows Defender.
Read: How to read Windows Defender Event Logs.
How to export Windows Defender logs?
To export Windows Defender logs in Windows 11, you can use this PowerShell command:
Get-WinEvent -LogName "Microsoft-Windows-Windows Defender/Operational" | Export-Csv -Path "C:\DefenderLogs.csv" -NoTypeInformation
This will dump all Defender events into a CSV file on your C drive, which you can open in Excel.
