Windows Defender will not complete Full Scan

Check which antivirus Windows reports as primary; if Malwarebytes is the active provider, temporarily uninstall it so Microsoft Defender can return to Normal mode before retrying the Full or Offline scan.

1. Confirm the active antivirus provider

Merely disabling Malwarebytes protection might not unregister it as the primary provider.

1. Open Windows Security.
2. Select Virus & threat protection.
3. Under Who’s protecting me?, select Manage providers.
4. Check which product is shown as turned on under Antivirus.
5. Open PowerShell as administrator and run:

Get-MpComputerStatus |
    Select-Object AMRunningMode,
                  AMServiceEnabled,
                  AntivirusEnabled,
                  RealTimeProtectionEnabled

The important result is AMRunningMode:

• Normal: Defender is active; leave Malwarebytes installed and continue to step 2.
• Passive or Defender disabled: if Malwarebytes is the active provider, temporarily uninstall Malwarebytes, restart Windows, and run the command again.

On Windows 11, a registered third-party antivirus normally places Defender in disabled or passive mode; Defender returns automatically when the other antivirus is removed.^1^

Do not manually change Defender service start values in the registry; Microsoft identifies that approach as unsupported and potentially capable of forcing a reimage.^2^

2. Run Defender Offline with Defender active

Because WinRE is already enabled, there is no reason to repeat reagentc /enable.

1. Confirm System type under Settings > System > About. Microsoft Defender Offline supports x64 Windows 11, but not ARM Windows 11.
2. Save all work and close applications.
3. If BitLocker/device encryption protects drive C:, suspend BitLocker protection before scanning. Suspension temporarily reduces drive protection, so resume it immediately after returning to Windows.
4. Open Windows Security > Virus & threat protection > Scan options.
5. Select Microsoft Defender Offline scan > Scan now.

Alternatively, from an elevated PowerShell window:

Start-MpWDOScan

This immediately restarts the PC and scans outside the normal Windows kernel. Defender must be the primary antivirus to receive Defender Offline updates; local administrator rights and enabled WinRE are also required.^3^

3. If Full Scan still ends with “RPC connection rundown”

Rebuild Defender’s security intelligence, then restart. This was recommended in a closely matching Windows 11 25H2 Insider case involving a repeatable Defender Full Scan engine failure; it does not establish that your RPC error has the same cause.^4^

Open Command Prompt as administrator and run:

"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -SignatureUpdate

The first command temporarily removes existing definitions, so do not stop after it. Confirm the second command succeeds, restart Windows, and retry the Full Scan.

4. Capture the actual scan failure

Open:

Event Viewer > Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational

Filter for:

• 1000 — scan started
• 1001 — scan completed
• 1002 — scan stopped before completion
• Nearby detection, engine, or error events at the same timestamp

Event 1002 mainly identifies the canceled scan and duration. Error codes, affected paths, engine versions, and signature versions can appear in nearby events.^5^

Export or copy the complete General and Details contents of the matching Event 1002 and adjacent error events. If the failure remains after Defender is in Normal mode, the definitions are rebuilt, and Offline Scan has run, submit those logs through Feedback Hub (Win+F) under Security, Privacy, and Accounts > Windows Defender Antivirus. There is no currently published Windows 11 25H2 release-health entry specifically identifying “RPC connection rundown” during Defender Full Scan.^6^

References

1. Microsoft Defender Antivirus compatibility with other security products
2. Troubleshoot Microsoft Defender Antivirus while migrating from a non-Microsoft solution
3. Run and review the results of a Microsoft Defender Offline scan
4. Windows Defender Full Scan Stops - Microsoft Q&A
5. Troubleshoot Microsoft Defender Antivirus scan issues
6. Windows 11, version 25H2 known issues and notifications