Where Does Windows Defender Store Quarantine?
Where Windows Defender keeps quarantine, scan history and settings on Windows for review and repair.
Last updated
Windows Defender centers on two trees under ProgramData: a Quarantine folder with neutralized files and a Scans History tree with detection records. Settings live in policy and the Security app rather than alongside them.
Restore through Protection history, never by hand copying quarantine contents. The store encrypts and renames items, so raw files open as gibberish outside the console. Browsing either tree needs admin rights.
Where Windows Defender stores this, by platform
C:\ProgramData\Microsoft\Windows Defender\Quarantine
Quarantine plus scan and detection history under ProgramData. Restore only through Protection history. Admin rights needed to browse either tree.
Frequently asked questions
How do I restore a quarantined file?
Open Windows Security, Protection history, and restore from there. Manual copies of the quarantine folder do not restore safely. The console tracks what was removed and from where.
Protection history is stuck. How do I clear it?
Stop the Defender services and rename the History folder, then reboot and rescan. Detections rebuild from fresh scans. Old history is gone for good, so screenshot open threats first.
Notice an outdated path? Let us know.