Where Does Defender Keep Quarantined Files?
Defender files quarantined threats and detection history under ProgramData, manageable only through the Security app.
Last updated
Defender's quarantine is a vault, not a folder. Flagged files move into ProgramData storage encrypted, with detection metadata tracked alongside. Browsing there shows names without contents.
All management flows through Windows Security: review, restore, allow, or delete from Protection history. Direct file surgery defeats the encryption and risks re exposure. Enterprise fleets see the same data through Defender for Endpoint instead.
Where Windows stores this, by platform
C:\ProgramData\Microsoft\Windows Defender\Quarantine
Encrypted quarantine storage plus detection history live here. Manage through Windows Security, Protection history, never by hand.
Frequently asked questions
How do I restore a false positive?
Open Windows Security, Protection history, and restore from there. Manual copies from the Quarantine folder arrive still encrypted and unreadable. The Security app is the only supported extraction route.
Where is the detection history?
Protection history in the Security app covers detections with allow and restore actions. The on disk files stay encrypted at rest, so browsing the folder directly reveals nothing usable.
Notice an outdated path? Let us know.