Windows 10: windows defender event viewer

Hi ,


I have a concern regarding the windows event viewer Microsoft-Windows-Windows Defender/Operational.

How to fetch the current signature version alone for the defender event id 2000 .


I have written a code below


LPWSTR pwsPath = L"Microsoft-Windows-Windows Defender/Operational";

//<xpath query goes here>

LPWSTR pwsQuery = L"*[System/EventID=2000]";
EVT_HANDLE hResults = NULL;
hResults = EvtQueryNULL, pwsPath, pwsQuery, EvtQueryChannelPath EvtQueryReverseDirection;
if NULL == hResults
{
EvtSeekhResults, 0, NULL, 0, EvtSeekRelativeToCurrent;
}


this will display all the details of eventid 2000 , I need only the current signature version of the latest event event id :2000


how to write the pwsQuery to obtain the required result

:)

 

Location of Windows Defender events saved in Event Viewer

In this https://docs.microsoft.com/en-us/wi...virus/troubleshoot-windows-defender-antivirus.
According to the the mentioned link the generated events should be displayed at the following location in the Event Viewer:- Application and Services Logs/Microsoft/Windows/Windows Defender Antivirus/Operational.

But on performing actions, Events are getting stored at this location in the event viewer:- Application and Services Logs/Microsoft/Windows/Windows Defender/Operational.

How can I get Microsoft Windows Defender Antivirus folder at this location:- Application and Services Logs/Microsoft/Windows in the event viewer. So that events start getting stored at this location:- Application and Services Logs/Microsoft/Windows/Windows
Defender Antivirus/Operational.

***Original title: Microsoft Defender Antivirus***

 

Windows Firewall Event Viewer questions

* Merged *

What does mean in the Event Viewer

"A rule has been added to the Windows Defender Firewall exception list"

 

Location of Windows Defender events saved in Event Viewer

Hi Sharoon,



Thank you for writing to Microsoft Community Forums.



I understand that your query related to saving the logs of Windows Defender on Event viewer.



The logs generated in Event Viewer for Windows Defender are saved by default under Windows Defender folder. We don’t have the option to create a custom folder to save the logs.



However, there is no such difference between Windows Defender Antivirus folder and Windows Defender folder in Event viewer, the events stored can still be used to analyze the logs created by Windows Defender.



I thank you for bringing this to our notice, you can provide the valuable feedback regarding the same using

Feedback Hub application on Windows 10 to improve the experience of using Windows.



Regards,

Prakhar Khare

Microsoft Community – Moderator