Scan Downloads with Microsoft Defender in Windows 10 and 11: Files, Folders and Archives

Prerequisites and Pre-Scan Safety Checks​

Before scanning a suspicious download, make sure your environment is configured so that merely browsing to the file or scanning it does not accidentally launch it or rely on outdated threat definitions.

• Do not double-click or extract unknown executables: Keep the downloaded item in your Downloads folder or a dedicated quarantine staging folder. If the download is a password-protected archive (.zip, .7z, .rar), Microsoft Defender cannot read inside encrypted archive containers until they are decrypted; if you must extract it to scan the contents, extract it to an empty folder and never double-click any extracted .exe, .msi, .bat, .cmd, .ps1, .vbs, .js, .scr, or .lnk file.
• Enable file name extensions in File Explorer: Attackers frequently disguise executables using double extensions such as Invoice.pdf.exe. On Windows 11, open File Explorer and select View > Show > File name extensions. On Windows 10, open File Explorer, select the View tab on the ribbon, and check File name extensions.
• Turn off the File Explorer Preview pane for untrusted folders: While rare, vulnerabilities in document or media preview handlers can be triggered when File Explorer renders a preview. On Windows 11, open File Explorer, select View > Show, and make sure Preview pane is unchecked. On Windows 10, select the View tab and make sure Preview pane is not highlighted.
• Verify Microsoft Defender Antivirus status and update definitions:
• Open the Start menu, type Windows Security, and open the Windows Security app.
• Select Virus & threat protection.
• Under Virus & threat protection settings, select Manage settings and confirm Real-time protection and Cloud-delivered protection are switched On.
• Return to the Virus & threat protection page, scroll to Virus & threat protection updates, and select Protection updates (or Check for updates).
• Select Check for updates to download the latest security intelligence definitions before scanning the suspicious file.
• Check for third-party antivirus conflicts: If you have another antivirus program installed as your primary security provider, Microsoft Defender normally enters passive or disabled mode, which can hide the Scan options menu and remove Scan with Microsoft Defender from the File Explorer context menu. You can enable Periodic scanning under Windows Security > Virus & threat protection > Microsoft Defender Antivirus options to use Defender for on-demand scans alongside a third-party scanner.

Method 1: Scan a Downloaded File or Folder from the File Explorer Context Menu​

The fastest way to inspect a single downloaded installer, document, or archive—or an entire subfolder of downloads—is directly from File Explorer.

On Windows 11​

• Open File Explorer (Windows key + E) and navigate to the folder containing the suspicious download (typically C:\Users\<YourUsername>\Downloads).
• Single-click the file or folder to highlight it, or hold Shift + right-click directly on the item.
• If you performed a standard right-click, select Show more options at the bottom of the context menu (or press Shift + F10 on your keyboard) to open the classic context menu.
• Select Scan with Microsoft Defender.
• The Windows Security app opens automatically to the Scan options page and immediately scans the selected path. Wait for the progress indicator to finish.

On Windows 10​

• Open File Explorer (Windows key + E) and navigate to the downloaded file or folder.
• Right-click the file or folder.
• Select Scan with Microsoft Defender from the context menu.
• Wait for the Windows Security window to open and complete the on-demand scan.

Method 2: Run a Custom Scan from the Windows Security App​

If the right-click context menu entry is missing, or if you prefer to initiate the scan from inside Windows Security without interacting with the file in File Explorer, use a Custom scan. Note that the Windows Security folder picker targets folders and drives rather than individual files; if you want to scan a single file with this method, place it in its own subfolder or scan the Downloads folder.

• Press the Windows key, type Windows Security, and press Enter.
• Select Virus & threat protection from the home screen or left navigation pane.
• Under the Current threats heading, click Scan options (located directly below the Quick scan button).
• Select the Custom scan radio button.
• Click the Scan now button at the bottom of the list.
• In the Browse For Folder dialog box that opens, navigate to the folder containing your download (for example, This PC > Downloads or C:\Users\<YourUsername>\Downloads), select the folder, and click Select Folder.
• Windows Security immediately begins scanning every file and subfolder inside the selected location.

Verification: How to Read Scan Results and Confirm a File Is Clean​

When a right-click scan or Custom scan completes, check the status banner under Current threats in the Windows Security window:

• Clean result: Windows Security displays No current threats, followed by Last scan: [Date/Time] (custom scan), the total files scanned, and the scan duration.
• Important verification check: Confirm that the files scanned count is 1 or greater. If a single-file scan reports 0 files scanned, the file may reside in a location or file type excluded from Microsoft Defender, or it may be locked or inaccessible. Check Virus & threat protection > Manage settings > Exclusions > Add or remove exclusions to verify that your Downloads folder or the file's extension is not on the exclusion list.
• Threat detected: Windows Security displays Threats found along with the malware classification name (for example, Trojan:Win32/... or PUA:Win32/...) and the severity rating (Low, Medium, High, or Severe). If Real-time protection is enabled, Defender typically quarantines or blocks the malicious file automatically during the scan and lists the remediation status under Current threats or Protection history.

Alternate Method: Scan Without Opening File Explorer Using PowerShell or Command Prompt​

If you suspect a folder contains files that might exploit a File Explorer thumbnail or shell extension bug, or if you want to script scans for a staging directory, you can scan any file or folder directly from Windows PowerShell or Command Prompt without opening a graphical folder view.

Using PowerShell (Start-MpScan)​

• Right-click the Start button and select Terminal or Windows PowerShell.
• Run the Start-MpScan cmdlet with -ScanType CustomScan and the exact -ScanPath to the file or folder:
  Start-MpScan -ScanType CustomScan -ScanPath "C:\Users\$env:USERNAME\Downloads\suspicious_file.exe"
• If the file is clean, the cmdlet finishes silently and returns you to the PowerShell prompt with no error output. If a threat is detected, Defender triggers an alert and remediates the file according to your configured threat actions.
• To verify the scan timestamp and inspect any detected threats in PowerShell afterwards, run:
  Get-MpThreatDetection

Using Command Prompt (MpCmdRun.exe)​

Microsoft Defender also includes a dedicated command-line utility (MpCmdRun.exe) that provides explicit console output indicating whether threats were found, and supports scanning without automatic remediation if you are performing forensic triage.

• Open Command Prompt (cmd.exe).
• Run MpCmdRun.exe with -Scan -ScanType 3 (which specifies a custom path scan) and -File pointing to the target file or folder:
  "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "%USERPROFILE%\Downloads\suspicious_file.exe"
• Check the console output:
• A clean scan prints:
  
  Code:

  Scan starting...
  Scan finished.
  Scanning C:\Users\<Username>\Downloads\suspicious_file.exe found no threats.

• If a threat is found, MpCmdRun.exe reports the number of threats detected and initiates cleaning unless -DisableRemediation was passed.

Safely Handling Flagged or Quarantined Downloads (Removal and Rollback)​

When Microsoft Defender flags a file during an on-demand scan, it isolates the file in an encrypted quarantine location (C:\ProgramData\Microsoft\Windows Defender\Quarantine) where the file cannot run or harm your PC. You should manage quarantined files exclusively through the Windows Security app or Defender's command-line tools—never by tampering with the ProgramData folder permissions.

How to Permanently Delete a Quarantined Download​

If the scan confirms a download is malicious or unwanted, you can purge it from quarantine immediately rather than waiting for Windows to automatically purge aged quarantine items:

• Open Windows Security and go to Virus & threat protection.
• Under Current threats, click Protection history.
• Click the Filters drop-down menu at the top right and select Quarantined items (if it is not already visible at the top of the chronological list).
• Click the flagged entry to expand its details. If prompted by User Account Control (UAC), select Yes (Administrator permissions are required to view full threat details and take action).
• Review the Affected items line to confirm the file path matches the download you scanned.
• Click the Actions drop-down button and select Remove to permanently delete the file from your drive.

Rollback: How to Restore a False Positive from Quarantine​

Warning: Restoring a quarantined item places the executable or archive back onto your file system where it can be opened and executed. Only restore a file if you have verified its cryptographic hash (Get-FileHash in PowerShell) against the official software publisher's website or confirmed with the developer that the alert is a false positive.

Click to expand...

• Open Windows Security > Virus & threat protection > Protection history.
• Select the quarantined item from the list and approve the User Account Control prompt if shown.
• Click Actions and select Restore.
• If Defender immediately re-quarantines a verified safe tool or script when you access it, return to Protection history, select the item, and choose Actions > Allow on device.
• Reversing an allowed threat later: If you ever need to revoke an allowed exception, go to Windows Security > Virus & threat protection > Allowed threats, expand the item, and select Don't allow.

You can also list or restore quarantined files from an elevated Command Prompt (Run as Administrator) using MpCmdRun.exe:

• To list all currently quarantined files:
  "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Restore -ListAll
• To restore a specific quarantined file by name to its original path:
  "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Restore -Name "suspicious_file.exe"

Troubleshooting Common Scan Failures and Escalation​

• "Scan with Microsoft Defender" is missing from the right-click menu:
• Windows 11 compact context menu: By default, Windows 11 hides legacy shell extensions on the primary right-click menu. Click Show more options at the bottom of the menu or press Shift + F10 to reveal Scan with Microsoft Defender.
• Third-party antivirus is installed: When another antivirus registers with the Windows Security Center, Microsoft Defender disables its active shell integration. Open Windows Security > Virus & threat protection, scroll down to Microsoft Defender Antivirus options, and toggle Periodic scanning to On. This re-enables on-demand scanning and restores the Scan options menu while keeping your third-party antivirus as the active real-time provider.
• Custom scan completes instantly with 0 files scanned:
• Check if the folder or file extension is listed under Windows Security > Virus & threat protection > Manage settings > Exclusions > Add or remove exclusions. On-demand custom scans honor path and extension exclusions by default. Remove the exclusion before scanning untrusted downloads.
• Check if the download is still in progress (for example, .crdownload in Edge/Chrome or .part in Firefox) or locked by another application. Wait for the browser to finish writing the file before scanning.
• Password-protected .zip, .7z, or .rar archive reports "No current threats" even though it looks suspicious:
• Malware distributors frequently place malicious executables inside password-protected archives (often supplying the password in the phishing email or download page) specifically because antivirus scanners cannot decrypt the archive contents without the password. If you extract the archive to a temporary folder with Real-time protection turned On, Defender will automatically scan the extracted files as they are written to disk, or you can right-click the extracted folder and select Scan with Microsoft Defender before opening anything inside.
• Start-MpScan or MpCmdRun.exe fails on a network share or mapped drive with 0x80508023:
• By default, Microsoft Defender might be configured not to scan network files during on-demand scans, or the elevated PowerShell session may not have access to a user-mapped network drive letter. Run Set-MpPreference -DisableScanningNetworkFiles $false in an elevated PowerShell prompt to allow network file scanning, and pass the full UNC path (\\Server\Share\Folder\file.exe) rather than a mapped drive letter (Z:\) or copy the file to a local non-executable staging folder first.
• When to escalate to Microsoft Defender Offline:
• If you accidentally opened or ran a suspicious download before scanning it, or if Defender repeatedly detects threats in system folders that reappear after removal, escalate to a pre-boot scan. Go to Windows Security > Virus & threat protection > Scan options, select Microsoft Defender Offline scan, and click Scan now. Save all open work first: your PC will restart into an isolated environment outside of Windows, scan for rootkits and persistent malware that hide while the OS is running, and reboot back to your desktop after roughly 15 minutes.

Correction (October 17, 2026): The "Reversing an allowed threat later" step previously told readers to select "Remove from allowed threats" on the Allowed threats page. The actual control in the Windows Security app is labeled "Don't allow" (per Microsoft's Protection History support documentation). The step has been corrected.