Windows Security Protection History is not deleting

[StymiedMike]

Everything I’ve read says Windows Security > Virus & threat protection > Protection History supposed to show for only 30 days by default. But mine has been there longer.

I followed the instructions here.
Configure remediation for Microsoft Defender Antivirus detections

I went into Group Policy & mine was set at “0” which meant always. So I changed it to 30 days & made sure it was Enabled. It’s been more than 30 days since the change & the history is still displayed. And it’s over 60 days based on the actual history dates. I then changed it to 2 days about a week ago but it made no difference.

I’ve read that the history can manually be deleted, but it would be nice to have it work automatically like it supposed to.

Any suggestions on how to fix this?
Thanks

 

[DR M]

From what I read, the Protection History is kept for 30 days by default. However, I can see items detected in my computer since November. So, I guess, the 30 days expiration period as a default setting is not valid.

 

[DR M]

Here is another article, saying that "Protection History only retains events for two weeks, after which they'll disappear from this page."

Protection History

As I said, I have there threads from November. So something else is the case.

Did anyone else notice the same thing? Not a big deal of course.

 

[Corrine]

Since nothing has ever been found on my PC, the Protection History is empty. However, it appears that others have the same issue and the suggested fixes did not solve the problem. However, you may still want to try the suggestions in How to remove Protection history of Windows Defender. (Personal comment: Greg Carmack is a long-time Windows expert and respected in the community.)

 

[DR M]

However, it appears that others have the same issue and the suggested fixes did not solve the problem. However, you may still want to try the suggestions in How to remove Protection history of Windows Defender. (Personal comment: Greg Carmack is a long-time Windows expert and respected in the community.)

I usually use the Method 1 to manually delete the Protection History.

P.S. Nothing on my PC too. But in my external disk I have a couple of executables which are always detected by Defender.

 

[PeterJ]

After reading the information at https://www.thewindowsclub.com/clear-windows-defender-protection-history I ran the following PowerShell command:

Get-MpPreference

That shows the ScanPurgeItemsAfterDelay value is set at 15. I never changed that.

 

[StymiedMike]

Since nothing has ever been found on my PC, the Protection History is empty. However, it appears that others have the same issue and the suggested fixes did not solve the problem. However, you may still want to try the suggestions in How to remove Protection history of Windows Defender. (Personal comment: Greg Carmack is a long-time Windows expert and respected in the community.)

I'll delete the Protection History using one of the methods mentioned in Greg Carmack's first link.

His second link to thewindowsclub does not work and I get a message "Error communicating with origin". It's the same whether I click on the link or do a copy/paste into my browser.

The second message posted to this thread used to be different. Was that deleted because it was not legit?

 

[StymiedMike]

After reading the information at https://www.thewindowsclub.com/clear-windows-defender-protection-history I ran the following PowerShell command:

Get-MpPreference

That shows the ScanPurgeItemsAfterDelay value is set at 15. I never changed that.

That link did not work for me, see above posting.

 

[StymiedMike]

I usually use the Method 1 to manually delete the Protection History.

P.S. Nothing on my PC too. But in my external disk I have a couple of executables which are always detected by Defender.

This looks similar to Method 1, but they're turning protection off & on. Does that make any sense?
https://answers.microsoft.com/en-us...ually-in/44aa804a-4e1a-46e2-8082-f64ff897ebdd

 

[DR M]

His second link to thewindowsclub does not work and I get a message "Error communicating with origin". It's the same whether I click on the link or do a copy/paste into my browser.

The WindowsClub site was down yesterday. Today it works again.

This looks similar to Method 1, but they're turning protection off & on. Does that make any sense?

When I want to delete the Service folder, I do not turn OFF/ON the protection.

That shows the ScanPurgeItemsAfterDelay value is set at 15. I never changed that.

Mine too. But it doesn't seem to work, meaning that the threats detected are kept and shown in the Protection History.


As a bottom line, in my opinion, the threats' appearance in the Protection History is not a big deal. After all, you have the choice to allow/remove/block/quarantine them. This is the important thing. If you don't want them to be shown as a history, then just delete the Service folder:

C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service

 

[StymiedMike]

The WindowsClub site was down yesterday. Today it works again.


When I want to delete the Service folder, I do not turn OFF/ON the protection.


Mine too. But it doesn't seem to work, meaning that the threats detected are kept and shown in the Protection History.


As a bottom line, in my opinion, the threats' appearance in the Protection History is not a big deal. After all, you have the choice to allow/remove/block/quarantine them. This is the important thing. If you don't want them to be shown as a history, then just delete the Service folder:

C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service

Method 1 states:
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service
5. Now, Delete all the files inside it.

Should I be deleting the foldername "Service" or just the files in it? Does it make a difference?

 

[DR M]

I delete the folder. If something is found, the folder is recreated.