Restore quarantined files in Microsoft Defender Antivirus (2024)

FAQs

Restore quarantined files in Microsoft Defender Antivirus? ›

On your Windows device, open Windows Security. Select Virus & threat protection and then, under Current threats, select Protection history. If you have a list of items, you can filter on Quarantined Items. Select an item you want to keep, and choose an action, such as Restore.

In Command Prompt, enter the following command: cd “%ProgramFiles%\Windows Defender”. Then type: MpCmdRun.exe -restore -listall to see a list of all currently quarantined files. You can restore a single file by typing: MpCmdRun.exe -restore -name “Filename”.

To go directly to the Quarantine page, use https://security.microsoft.com/quarantine. Admins can configure how long messages are kept in quarantine before they're permanently deleted in anti-spam policies. Messages that have expired from quarantine are unrecoverable.

When suspected malicious files are quarantined, they remain isolated to prevent your computer becoming infected. The suspected malicious file is not deleted but instead moved from its original location to a safe place on your computer where it is unable to run as a program.

Most files detected by Microsoft security software are quarantined. This means the file is moved and stopped from running or doing anything to your PC. A quarantined file does not pose any risk to your PC. You can leave a file in quarantine for as long as you like.

Quarantined items are stored in a secure folder to stop them from being used or accessed.

Many people say that Windows Defender and common sense are all that anyone needs. Ultimately, whether it's good enough is a subjective question. As an anti-malware tool, it can do the job in most cases. I'd say it's at its weakest when it comes to baseline malware detection.

Files in Quarantine are stored in a special format and are not dangerous. Quarantine also stores files that are probably infected by viruses and other computer security threats, or objects that can't be disinfected at the time of detection.

If you're certain a quarantined file isn't a threat, you can restore it on your Windows device. On your Windows device, open Windows Security. Select Virus & threat protection and then, under Current threats, select Protection history. If you have a list of items, you can filter on Quarantined Items.

In summary, whenever Defender puts a file into quarantine, it does three things: A bunch of metadata pertaining to when, why and how the file was quarantined is held in a QuarantineEntry . This QuarantineEntry is RC4-encrypted and saved to disk in the /ProgramData/Microsoft/Windows Defender/Quarantine/Entries folder.

How long is Windows Defender quarantine? ›

Quarantine items are available for 30 days. After 30 days, these emails expire and cannot be reviewed or released. How often will I receive an email notification to check my quarantine? You will receive a notice daily, but you can check your quarantine at any time by visiting https://security.microsoft.com/quarantine .

In most cases, Windows Defender will quarantine only harmful files. Quarantined files no longer pose a threat to your computer, and you can safely remove them: Check the box next to each item you want to remove. Click Remove.

These files get removed from the disk location where they are quarantined and can no longer harm your device.