Forum Discussion

VeOl's avatar
VeOl
Copper Contributor
Oct 31, 2026

Microsoft Defender Offline scan: BitLocker recovery prompt and missing scan results on Windows11 Pro

Microsoft Defender Offline scan not completing or recording results — Windows 11 Pro

I need help fixing Microsoft Defender Offline and verifying that scans complete successfully.

History:

  • Initially, starting an Offline scan rebooted Windows, but no scan screen appeared. The process lasted less than a minute on a laptop with 1 TB of storage. No result appeared in Protection history.
  • SFC and DISM reported no system corruption.
  • Windows repair failed with error 0xC1900101–0x20017; factory reset also failed.
  • During clean installation, a technician changed or repaired something in the BIOS to resolve a storage-partition recognition problem. Windows then installed successfully.
  • BitLocker is enabled on C: and D:. WinRE has since been repaired and enabled.

Current behaviour:

  • Defender Offline requests the BitLocker recovery key for C: after reboot.
  • After I enter it, the Defender Antivirus scan screen appears and displays progress. The background also displays “Preparing for recovery.” (?!?!, I ran a scan, not a recovery)
  • Windows starts normally afterward, but no new Offline scan result appears in Protection history.

Event Viewer findings (31 October, around 1:52 pm):

  • Event 1000 shows a Quick Scan started by scheduled maintenance.
  • Event 1002 shows the same scan stopped before completion, with reason “RPC connection rundown.”
  • I did not schedule or run a Quick Scan; I initiated only Defender Offline at that time. Other events around the same time include 1150, 1151, 1152, and 5007. Theee is also an event 2030 at 12:51pm, when I ran the offline scan for the first time today.

Questions:

  • Why do the events report a scheduled Quick Scan when I initiated Defender Offline?
  • How can I fix this and verify that Offline scans complete successfully?
  • Could BitLocker, WinRE, TPM, Secure Boot, or the previous BIOS repair be involved?

I want to resolve this without reinstalling Windows if possible.

Microsoft Support case: 7110599710.

automation
incident response
Microsoft Defender Experts

1 Reply

  • Jamony's avatar
    Jamony
    MCT
    Nov 04, 2026

    Your Offline scan now reaches its progress screen after unlocking C:, but you still lack evidence that it completed. Event 2030 confirms preparation for the next reboot; it is not a completion event. A 1000/1002 pair labelled scheduled Quick Scan describes that scan’s start and cancellation, not proof that Offline was converted into a Quick Scan.

     

    Check reagentc /info from an administrator terminal to confirm WinRE remains enabled, then update Defender’s security intelligence. Record the exact start and return times of one Offline run and compare Protection history with the Defender Operational log. Correlate ordinary scan events by Scan ID; event 1001 denotes completion for that recorded scan.

     

    BitLocker and WinRE are relevant prerequisites, but these logs cannot establish a TPM, Secure Boot or BIOS defect. Keep their settings unchanged and provide the timeline and exported logs privately through your existing support case before considering another reinstall.