MSERT (msert.exe): What It Is & How to Run Microsoft Safety Scanner

msert.exe is Microsoft Safety Scanner — a free, portable, on-demand malware scanner published by Microsoft. MSERT is the filename, Microsoft Safety Scanner is the product name, and they are the same thing. This guide covers what the file is, how to confirm the copy you have is genuine, how to run it properly, and how to read what it found.

If you arrived here because you spotted msert.exe on your machine and want to know whether it belongs there, start with the next two sections.

What Is msert.exe?

It is a single self-contained executable that scans Windows for malware, removes what it finds, and attempts to reverse changes made by identified threats. Its defining characteristics:

• Portable. It does not install. There is no setup, no Start menu entry, no desktop icon, and no uninstaller. It runs from wherever you saved it.
• On-demand only. It scans when you launch it and then exits. It is not a service and does not run in the background.
• No real-time protection. Microsoft is explicit that it does not replace an anti-malware product. It is a second opinion, not a shield.
• Self-contained definitions. The malware signatures ship inside the executable, which is why it expires — see the 10-day expiry.
• Signed with SHA-2 only. Devices must support SHA-2 code signing to run it.

It supports Windows 11, Windows 10, Windows 8.1 and 8, Windows 7, and Windows Server from 2008 R2 onward, in 32-bit and 64-bit builds.

Is msert.exe Safe? How to Verify It Yourself

The genuine file is safe. But "a file called msert.exe is safe" is not a useful answer, because malware routinely adopts legitimate filenames precisely so that a search like the one you just did returns reassurance. Check the copy you actually have.

1. Check the digital signature

This is the definitive test.

1. Right-click the file and select Properties.
2. Look for a Digital Signatures tab.
3. Open it. The signer should be Microsoft Corporation.
4. Select the signature, choose Details, and confirm the certificate is valid.

If there is no Digital Signatures tab at all, the file is not from Microsoft. That is the single clearest red flag. From PowerShell, the same check:

Get-AuthenticodeSignature .\msert.exe | Format-List Status, SignerCertificate

Status should be Valid.

2. Check where it is

Windows never installs msert.exe. It is not a built-in component, so it should only exist somewhere you put it — usually Downloads. Locations that deserve a second look:

• Running from %TEMP%, AppData, or a user profile folder you did not download to
• Sitting in C:\Windows\System32 or another system directory
• Present on a machine where nobody remembers downloading it

None of those are proof of infection on their own — an IT administrator or a support technician may have left a copy behind, which is a common and innocent explanation. But combined with a missing or invalid signature, treat the file as hostile.

If you want to check a suspicious copy against threat intelligence, our file hash checker hashes the file locally in your browser and looks the hash up against malware databases without uploading the file itself.

3. Expect a browser warning — it is a false positive

Chrome and Edge frequently warn that msert.exe "isn't commonly downloaded" or "could harm your device". This is a reputation signal, not a detection. Microsoft republishes Safety Scanner constantly with fresh definitions, so each individual build is downloaded by comparatively few people and never accumulates the download history that suppresses the warning.

The right response is not to disable the warning reflexively but to confirm two things: that you downloaded from Microsoft's own page, and that the signature check above passes. Then proceed.

Can I delete it?

Yes, and you probably should. Microsoft's stated removal instruction is simply to delete the executable. There is no service to stop, no registry to clean, and no uninstaller to run. Because the copy expires anyway, deleting it after a scan and downloading fresh next time is the correct habit. The log file at %SYSTEMROOT%\debug\msert.log remains and is harmless.

Download Microsoft Safety Scanner

Download only from Microsoft. Third-party "download portals" hosting security tools are a well-worn malware delivery route.

• Microsoft Safety Scanner — 64-bit (most machines)
• Microsoft Safety Scanner — 32-bit
• Official page: Microsoft Safety Scanner Download

Not sure which build you need? Check Settings → System → About → System type. When in doubt on any machine from the last decade, use 64-bit.

The file downloads as msert.exe. Note where you saved it, because nothing will appear in the Start menu afterwards — a genuinely common source of "I downloaded it, where did it go?" confusion.

Scanning a machine that is too infected to browse: download on a clean computer, copy msert.exe to a USB drive, and run it on the affected machine. The tool needs no installation and no internet connection to scan, which is what makes it useful when malware is blocking security software from installing.

Running a Scan

1. Double-click msert.exe.
2. Approve the User Account Control prompt — it needs administrator rights to scan and clean properly.
3. Accept the license terms and click Next.
4. Choose your scan type.
5. Let it run to completion without closing the window.
6. Review the results, then restart if anything was removed.

Scan types

Start with a quick scan. A full scan is a serious time commitment and is rarely the right opening move — run it overnight if the quick scan turns something up.

Running MSERT from the Command Line

For scripted or unattended use:

msert.exe /Q          Quiet — runs the scan with no user interface
msert.exe /F /Q       Quiet full scan

Run these from an elevated command prompt or PowerShell session. With /Q there is no window and no on-screen summary, so the log file is your only output — read %SYSTEMROOT%\debug\msert.log afterwards.

An honest caveat about switches. Microsoft does not publish a complete command-line reference for msert.exe. /Q and /F are the two that are reliably attested. Switch lists circulating online — typically /Q, /N, /F and /F:Y — are largely borrowed from MRT.exe, the separate Malicious Software Removal Tool, and are not documented by Microsoft for Safety Scanner. If you intend to build automation around /N (detect without removing) or /F:Y, verify the behavior on a test machine first rather than trusting a switch table. That advice applies to the version of this list that used to appear on this page too.

Remember that the executable expires ten days after download, which makes MSERT a poor fit for a recurring scheduled task: any script must download a fresh copy each run, or it will silently stop scanning.

Where the MSERT Log File Is

%SYSTEMROOT%\debug\msert.log

On a standard installation that resolves to C:\Windows\debug\msert.log. Paste the path with the variable into the Run dialog (Win + R) or Explorer's address bar and it will open in Notepad.

The log is worth reading even when the on-screen summary says everything is fine. It contains the full path of every detected item, the threat name assigned to it, and the action taken — detail the summary screen omits. If you need to hand findings to someone else, this file is what to send.

msert.log is also the only output when you run with /Q.

Reading Your Results

No threats found. Nothing matched Microsoft's definitions. This is reassuring but not conclusive: MSERT scans on demand with the definitions frozen at download time, and no scanner detects everything. If symptoms persist, the absence of a detection is a data point, not a verdict.

Threats found and removed. Restart the machine to complete cleanup, then run a second scan afterwards to confirm nothing regenerated. Malware that reinstalls itself after removal usually shows up as the same detections reappearing on the follow-up scan — a strong sign of a persistence mechanism the scanner has not removed.

Threats found but not removed. Some malware cannot be cleaned while Windows is running normally, because the files are locked or the malware is actively defending itself. Options, in order: run the scan again in Safe Mode, or use Microsoft Defender Offline, which scans from a trusted environment before Windows loads and is substantially more effective against entrenched infections.

The same detections every time you scan. Either something is restoring the files, or the detections are in a location the scanner cannot clean — a system restore point or a backup archive, for instance. Worth escalating rather than repeating the scan.

MSERT Error Codes

Safety Scanner reports failures as hex error codes. Microsoft documents these in How to troubleshoot an error when you run the Microsoft Safety Scanner. The ones that come up most:

The pattern is worth internalizing: for most MSERT errors, the fix really is to download a fresh copy. A stale or partially downloaded executable is the single most common cause of the tool failing to start, which loops back to the expiry rule below.

The 10-Day Expiry

Safety Scanner expires 10 days after you download it. After that it stops working entirely.

This is deliberate rather than an annoyance. The malware definitions are compiled into the executable, so an old copy scans with old signatures. Rather than let people run a two-month-old scanner and trust the clean result it reports, Microsoft makes it stop.

What this means in practice:

• Download a fresh copy before every scan. Do not keep one on a USB stick and reuse it.
• If MSERT will not start, check the download date before troubleshooting anything else. Expiry looks like a broken file.
• It is unsuitable for scheduled scans unless your script re-downloads it each time.
• The definition version in any given build matches what Microsoft publishes on its security intelligence updates page.

A freshly downloaded MSERT is also a useful stopgap when Defender's own definitions will not update. The classic symptom is Windows Update repeatedly failing to install KB2267602 with error 0x80070643 — Defender keeps running on stale signatures until that is resolved, and a current Safety Scanner gives you an independent scan in the meantime.

MSERT vs MRT.exe vs Microsoft Defender

Three Microsoft anti-malware tools that people routinely mix up:

The practical distinction: MRT is a narrow monthly sweep for widespread threats, Defender is your actual protection, and MSERT is the one you reach for when you want a thorough second opinion from a tool that owes nothing to whatever is already running on the machine.

What MSERT Does Not Do

Be clear about the limits before you rely on it:

• It does not protect you. No real-time scanning, no web filtering, no behavioral blocking. It is inert until you run it.
• It does not replace your antivirus. Microsoft says so directly. Keep Microsoft Defender Antivirus or another resident product running.
• It does not update itself. Definitions are frozen at the moment you downloaded it.
• It cannot always undo the damage. It attempts to reverse changes made by identified threats, but "attempts" is the operative word — a cleaned machine is not necessarily a restored one. Settings, permissions, and files altered by malware may need manual repair.
• A clean result is not a guarantee. It means nothing matched the definitions it shipped with.

If MSERT keeps finding the same threats, or finds nothing while the machine clearly misbehaves, escalate to Microsoft Defender Offline or to a professional. Repeatedly rerunning an on-demand scanner is not a remediation strategy.

Related Articles

• How to Release Files from Microsoft Quarantine
• How to Disable Microsoft Compatibility Telemetry