Windows 10: Windows 10 1809 - Win Defender Quarantine - Files are deleted?

Hello,

I have a SCCM installation (current branch) and Windows 10 1809 deployed. As i started to prepare this network almost from scratch, the Endpoint Protection was centralized with Windows Defender and SCCM Endpoint Protection policies. Everything is working as expected, or almost.

The policy I have is set for quarantine all items, except the low ones. After some detection, and also some tests, malware/virus are cleaned as expected but they are not quarantined, they just vanish. When I go to history I have the detection but only an allow option and an error bellow the file name.

The quarantine folder for Defender is empty and also using CMD to check the threats it just says empty. I checked the GPO and also tried to force the option 2 for all levels (quarantine option) and put 60 days for quarantined files, the same I have on my policy.



After this I installed a fresh VM, outside the domain and made the same tests (some of them with the ATP testing scenarios or EICAR files). Initially I though it was working but after that but I have the same behaviour. As I wanted to try Defender ATP I just onboarded 2 VMs and made some tests. Even then I have the file was quarantined but then, nothing, I can't restore it and in Full History only have allow and nothing more (some times I don't have any option).

Lastelly deleted by PowerShell the preferences for every level, restarted the VM, and tried again...the same behaviour. I thought that it could be SCCM, then GPO but I think is something else.

My SOC team, and I, wanted to check some strange files received from email but we just can't restore them, there is no option to do so. I really don't know what is wrong and where can I check other options for quarantined items, etc.

Did anyone have a similar behavior? Thank you in advance!

submitted by /u/fateles
[link] [comments]

:)

 

Defender deletes quarantined files.

How do I recover a file that Defender quarantined then deleted(or did something with it) without permission.

 

Windows Defender is missing Restore Button for Quarantined Threats

It wasn't listed under "Quarantined Threats", but was listed in "See full history" as quarantined. It has been about 2 hours
and now it is listed under "Quarantined Threats" which now shows the Restore or Delete options. Something must be causing
a delay in listing the quarantined file under "Quarantined Threats" after they have been found and quarantined by Defender.

 

quarantine folder for win defender

If you want to restore quarantined files - Restore quarantined files in Windows Defender AV -

https://docs.microsoft.com/en-us/windows/securi...