Windows 10: Why quarantined files as logged in Event Monitor are not listed in Windows Defender's...

I am developing a dll library. It keeps getting quarantined by Windows Defender which is fine, I like to see that it is working from time to time. But then, I cannot restore it from quarantine at any time.After some digging and monitoring in Event Log, less than half of the quarantined items are ever listed under MpCmdRun.exe -restore -listall, and probably less than 10% are listed under Windows Defender security settings -> Protection History. And why is that? Why can't I see all of the quarantined files?It goes like this.I am deploying my dll. Shortly after it disappears, and a message

:)

 

Windows Defender is missing Restore Button for Quarantined Threats

It wasn't listed under "Quarantined Threats", but was listed in "See full history" as quarantined. It has been about 2 hours
and now it is listed under "Quarantined Threats" which now shows the Restore or Delete options. Something must be causing
a delay in listing the quarantined file under "Quarantined Threats" after they have been found and quarantined by Defender.

 

Saves log files ?

You can either read the files in Windows or my preferred method is.....

Download CCcleaner from here...........

CCleaner Professional | Try the world’s most trusted PC cleaner, free!

You can then run cleaner, you will see the log files listed, then if you right click you can save as a text file and then have a read. You may also get an "error reporting" log listed seperatly.

 

windows defender quarantine

Julia,

GreginMich
replied

Where to restore quarantined items in Windows 10 creator update?

Nothing has changed. We still have erroneous status reports in the Full history page just like we did in the All detected items page in the classic Defender interface. If a threat doesn't appear in the Quarantined threats list on the Scan history page,
then it wasn't actually quarantined.

So we need to correct the documentation here:

https://www.microsoft.com/en-us/wdsi/help/antimalware-faq

On Windows Defender Antivirus for Windows 10 version 1703 and later:

• Use the Windows search box to find and open the Windows Defender Security Center
• Navigate to the Virus & threat protection > Scan history.
• Under Quarantined threats, select
  See full history

On earlier versions of Windows:

• Open Microsoft Security Essentials or Windows Defender.
• Click the History tab.
• Select Quarantined items and then View details. You might be asked for an admin password or to confirm your choice.

Once you have reviewed the quarantined items you can:

• Select Remove all to delete all quarantined software.
• Select individual files, and then click Remove or
  Restore.

`~`