On the restart, you will see a black command ... See: Read Windows Defender Event Log using WinDefLogView. UPDATE: In Windows 11/10, you can access the Windows Defender Offline Scan setting ...