Microsoft Safety Scanner Review 2026: Free msert.exe Tested

Microsoft Safety Scanner at a glance

Microsoft Safety Scanner is a free scan tool from Microsoft that finds and removes malware on Windows computers ^[1]. It comes as one portable file, msert.exe, which you download, run, and delete when you are done ^[1].

It does not install, does not run in the background, and does not update itself. Each copy stops working 10 days after you download it, so every new scan starts with a fresh download ^[1]. Microsoft says plainly that the tool does not replace your anti-malware product ^[1].

In short, it is a second opinion scanner. You use it when you suspect an infection, when your main antivirus missed something, or when you want to check a PC you do not normally look after.

• Best for: a one-off malware check on a Windows PC, next to the antivirus you already have.
• Platforms: Windows 11, 10, 8.1, 8 and 7, plus Windows Server 2008 R2 through 2019, as listed by Microsoft ^[1].
• Price: free. There is no paid edition, no licence key and no subscription.
• Detection data: the same security intelligence Microsoft publishes for Defender Antivirus ^[1][3].
• Removal: delete msert.exe. There is nothing to uninstall ^[1].

How we reviewed it and how we earn money

2-spyware first tested Microsoft Safety Scanner in 2018 on a Windows 7 PC. The screenshots in this review come from that test, with program version 1.0.3001.0 shown in the window title. The wizard layout of Quick, Full and Customized scans is the same one Microsoft still describes today ^[1][2].

For this 2026 update we checked every fact against Microsoft Learn, Microsoft Support and the Microsoft Security Intelligence update page. For the built-in alternative we used independent lab results from AV-TEST. Each source is listed at the bottom with the date we read it.

We have no deal with Microsoft and earn nothing from this review. 2-spyware earns a commission only from partner products, such as the Fortect offer shown on this page.

What is Microsoft Safety Scanner?

Microsoft describes Safety Scanner as a scan tool designed to find and remove malware from Windows computers. You download it, run a scan, and it tries to reverse changes made by the threats it identifies ^[1].

The tool is part of the Microsoft Defender documentation on Microsoft Learn, which is where Microsoft publishes the official download page ^[1]. Some Microsoft Support pages call it the Microsoft Defender Safety Scanner ^[4].

People often search for it under other names. Microsoft security scanner, Windows safety scanner, MS safety scanner and MSERT all point to the same free tool. The file name msert.exe is the default name of the download ^[1].

What it scans for

In our test the scanning window said the tool checks for viruses, spyware and other potentially unwanted software, and removes any that it finds. When the scan ends, it shows a report of what was detected and removed.

That covers the usual mix of Trojans, worms, spyware, adware and potentially unwanted programs that Defender also detects. Microsoft has also changed how Windows treats unwanted apps over the years, which we explain in our article on potentially unwanted apps being blocked.

How Safety Scanner works: the three scan types

Running the tool takes three steps, according to Microsoft. You download and open it, select the type of scan and start it, then review the results on screen ^[1]. Before any scan, you must accept the Microsoft license terms in the first window.

Quick scan

The quick scan checks the areas of the system most likely to contain viruses, spyware and other unwanted software. If it finds something, the tool may prompt you to run a full scan. This is the right choice for a first check.

Full scan

The full scan checks the entire system. The wizard warns that it can take up to several hours on some computers. Microsoft also asks for a full scan when a quick scan cannot finish a removal, under error code 0x80508024 ^[2].

Customized scan

The customized scan runs a quick scan and also checks a folder you choose. It suits a downloads folder or a USB drive that you do not trust. Microsoft uses the same option to fix error 0x80508019, when the scan destination does not exist ^[2].

The old version of this review said you could upload suspicious files to the scanner. That is not quite right. The customized scan checks a local folder. Sending a file to Microsoft for analysis is a separate web service that Microsoft links from the download page ^[1].

Results and the msert.log file

When the scan ends, the tool shows a summary. For detailed results, Microsoft points to the log at %SYSTEMROOT%\debug\msert.log ^[1]. On most PCs that is C:\Windows\debug\msert.log ^[2].

The log is the place to look if something went wrong. Error codes in it start with 0x, and Microsoft publishes a table of them with fixes ^[2].

Is Microsoft Safety Scanner free?

Yes. Microsoft Safety Scanner is free, with no trial period, no paid upgrade and no account. There is nothing to activate and nothing to cancel.

The only limit is time. A downloaded copy expires 10 days after download. To scan again with the latest definitions, you download and run it again, and Microsoft recommends doing that before each scan ^[1].

Is Microsoft Safety Scanner safe or a virus?

The genuine tool is safe. It is published by Microsoft on Microsoft Learn, and Microsoft notes that Safety Scanner is exclusively SHA-2 signed ^[1]. That digital signature lets Windows confirm the file comes from Microsoft.

The risk is fake copies. Because people search for the tool by name, other sites offer files called msert.exe or Safety Scanner. Only use the download page on Microsoft Learn, which offers a 32-bit and a 64-bit file ^[1].

You can check a downloaded file yourself. Right-click msert.exe, open Properties, then the Digital Signatures tab. The signer should be Microsoft Corporation. If there is no signature tab or another name appears, delete the file.

The SHA-2 signing also explains a common error on old PCs. Devices must be updated to support SHA-2 to run the tool, so an unpatched Windows 7 PC may refuse to start it ^[1].

Is Microsoft Safety Scanner good?

For what it is meant to do, yes. It uses the same security intelligence version that Microsoft publishes for Defender Antivirus ^[1][3]. On 2026-10-08, that page listed security intelligence version 1.459.601.0 and engine version 1.1.26080.3 ^[3].

No independent lab tests Safety Scanner on its own. AV-TEST does test Microsoft Defender Antivirus, which shares the same detection data. In the August 2026 Windows 11 test, Defender scored 6 out of 6 for protection, 5.5 for performance and 6 for usability, and earned the Top Product award ^[7].

Those scores apply to the full Defender product with real-time and cloud protection. A single on-demand scan with Safety Scanner cannot match that, because it only sees what is on disk when you run it. Treat the lab result as a sign of the quality of the detection data, not as a score for the scanner.

The 10-day limit and why there are no updates

Safety Scanner only scans when manually triggered, and it expires 10 days after download ^[1]. This is a design choice. Each download carries the definitions of that day, so an old copy would miss new threats.

The earlier version of this review said you had to uninstall and reinstall the tool every ten days. That was not accurate. Nothing is installed in the first place. You simply delete the old msert.exe and download a new one when you need another scan ^[1].

The tool is also easy to lose. It does not appear in the Start menu or as a desktop icon, so Microsoft suggests you note where you saved the download ^[1].

Microsoft Safety Scanner vs Windows Defender

Windows Defender is now called Microsoft Defender Antivirus. It is built into Windows 11 and Windows 10, runs all the time, and updates itself. Microsoft names it as the product to use for real-time protection with automatic updates ^[1].

Safety Scanner and Defender share the same security intelligence ^[1][3]. The difference is how they run. Defender watches files as you open and download them. Safety Scanner only checks the disk when you start it, and then it is gone.

So the two do not compete. If Defender is on and up to date, a Safety Scanner run is a quick second look with the same data. It is most useful when Defender is turned off, broken, or replaced by another antivirus that you suspect missed something.

The old review said Defender only detects spyware on Windows 7 and below. That described the old Windows Defender anti-spyware tool. Today Microsoft Defender Antivirus is a full antivirus in Windows 10 and 11, with the lab results above ^[7].

When to use Defender Offline instead

Some malware hides while Windows is running. For that, Microsoft offers Microsoft Defender Offline. It restarts the PC into a trusted environment outside the normal Windows kernel, so it can target rootkits and threats that infect the master boot record ^[5].

The offline scan takes about 15 minutes and restarts the PC when it finishes ^[5]. It is built into Windows 10 version 1607 and later and Windows 11 ^[5]. If BitLocker protects your system drive, suspend it first, or Windows may ask for the recovery key ^[5]. Our guide shows how to run a Microsoft Defender Offline scan.

Safety Scanner vs MSRT

The Windows Malicious Software Removal Tool, or MSRT, is another free Microsoft tool. Microsoft usually releases it monthly through Windows Update, and also as a standalone download ^[4].

MSRT is narrow by design. It looks for specific prevalent threats such as viruses, worms and Trojan horses, and Microsoft states that it does not remove spyware ^[4]. It also cannot remove malware that is not running ^[4].

For wider detection, Microsoft itself points from MSRT to Safety Scanner and Defender Offline ^[4]. That is the clearest summary of the difference. MSRT is a monthly sweep for common threats; Safety Scanner is a full scan with current definitions.

Microsoft Safety Scanner vs Malwarebytes

Malwarebytes is a third-party security product with a free edition and paid plans. Its free page lists Windows, Mac, Android and iOS, and shows paid Premium plans from $59.99 per year for Standard, as read on 2026-10-08 ^[8].

The two tools differ in how they live on your PC. Malwarebytes Free is installed software that you keep and update. Safety Scanner is a single file that expires after 10 days and leaves nothing installed ^[1].

Our 2018 test found Malwarebytes Free quick to finish and limited to one main scan, while Safety Scanner offered Quick, Full and Customized scans. We did not retest Malwarebytes for this update, so treat those notes as historical.

Which one to pick depends on the job. For a one-time check on a PC that already runs Defender, Safety Scanner is enough and installs nothing. If you want a second scanner that stays on the PC and works on a Mac too, Malwarebytes fits better. For a longer look at the product, see our Plumbytes vs Malwarebytes comparison.

Troubleshooting Safety Scanner errors

If a scan fails, open the log. Microsoft's steps are to type %systemroot%\debug in the Start search box, open the file named msert, and look for codes that start with 0x ^[2].

Most errors share one fix: download a fresh copy. That also solves the expiry problem, since an expired copy will not scan.

How to remove Microsoft Safety Scanner

There is no uninstaller and no entry in Apps or Programs and Features. To remove the tool, Microsoft says to delete the executable file, which is msert.exe by default ^[1].

1. Find msert.exe where you saved it, usually the Downloads folder.
2. Close the scanner if it is still open.
3. Delete msert.exe and empty the Recycle Bin.
4. Optional: delete the old log at C:\Windows\debug\msert.log if you no longer need the results. Microsoft's removal step names only the executable ^[1].

Since nothing else is installed, there is no subscription to cancel and no refund to request. If a program called Safety Scanner asks you for payment, it is not Microsoft's tool.

Old Windows versions and Microsoft Security Essentials

Microsoft still lists Windows 7, Windows 8 and Windows Server 2008 R2 in the system requirements, and refers to its Lifecycle Policy for details ^[1]. Support for Windows 7 for home users ended on January 14, 2020, so these systems no longer get security updates.

The old review suggested Microsoft Security Essentials as a way to avoid redownloading the scanner. That advice is out of date. Microsoft Security Essentials reached end of service on January 14, 2020 and is no longer available as a download ^[6]. Microsoft recommends moving to a current Windows version with Defender Antivirus ^[6].

Cracks, keygens and fake Safety Scanner downloads

Safety Scanner is free, so there is no crack, licence key or premium version to buy. Any page offering one is a warning sign. Sites that push cracks and keygens are a common way malware spreads, as our article on cracked Windows 11 copies shows.

Security tools flag many key generators as hacking tools for this reason. See our page on Hacktool:Win32/Keygen to learn what that detection means.

Who Microsoft Safety Scanner is for

• Home users who want a free second opinion next to Defender or another antivirus.
• Anyone fixing a relative's or friend's PC who does not want to install software on it.
• Technicians who need a portable scanner with current Microsoft definitions on a USB drive, downloaded fresh each time.
• Users whose antivirus is not working and who need a quick check before reinstalling protection.

It is not the right tool if you want always-on protection, scheduled scans or web filtering. For those, keep Microsoft Defender Antivirus turned on, or use a full security suite.

It is also a scanner, not a repair tool. If malware damaged Windows system files or settings, removing the threat does not restore them. Fixing that kind of damage is the job of Windows' own repair options or a repair product such as Fortect, our partner, which we cover in the Fortect review.

Microsoft Safety Scanner pros and cons

• Free, with no account, licence key or subscription.
• Portable: nothing is installed and removal means deleting one file ^[1].
• Uses the same security intelligence Microsoft publishes for Defender ^[1][3].
• Three scan types, including a customized scan of any folder.
• Clear log file and a published error code table ^[1][2].

The limits come from its design. It has no real-time protection, no scheduler and no automatic updates. Each copy works for 10 days, and a full scan can take hours on a large disk.

Verdict: is Microsoft Safety Scanner worth using?

Yes, for the job it was built for. Microsoft Safety Scanner gives you a free, signed, portable scan with Microsoft's current detection data, and leaves nothing behind. As a second opinion, it is one of the simplest tools available.

Just keep its role in mind. It is not an antivirus and Microsoft does not present it as one ^[1]. Keep Defender Antivirus or another real-time product running, use Safety Scanner when you want a second look, and download a fresh copy each time.