Where Does Defender Keep Quarantined Files?
Microsoft Defender quarantine folder on Windows, why it is locked, and the supported restore route.
Last updated
Defender isolates threats under ProgramData in a Quarantine folder with restricted access. Files there are encrypted and renamed, not simply moved.
The folder is intentionally hostile to browsing. Protection history in Windows Security is the interface; the on-disk folder is an implementation detail.
Where Windows stores this, by platform
C:\ProgramData\Microsoft\Windows Defender\Quarantine
Restricted, Tamper-Protection-guarded storage. Manage items through Windows Security > Protection history, not Explorer. Admin rights required even to list it.
Frequently asked questions
How do I restore a quarantined file?
Open Windows Security > Protection history, find the item, and choose Restore. That is the supported path. Pulling files from the folder by hand risks re-triggering protection and corrupting metadata.
Defender keeps quarantining my tool. How do I stop it?
Add an exclusion in Windows Security > Virus and threat protection > Manage settings > Exclusions. Verify the file is actually safe first; exclusions blind the scanner permanently for that path.
Notice an outdated path? Let us know.