Solved How to Remove Items in Defender History

Josey Wales said:

Clear Windows Security History

The above Tutorial may do it.

If is doesn't this will:

Code:

<# : batch script
@echo off
powershell -nop "if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] 'Administrator')) { Start-Process -Verb RunAs 'cmd.exe' -ArgumentList '/c %~dpnx0 %*' } else { Invoke-Expression ([System.IO.File]::ReadAllText('%~f0')) }"
goto :eof
#>

# https://www.tiraniddo.dev/2019/09/the-art-of-becoming-trustedinstaller.html

$ScriptBlock = {
    $MAPS_Status = (Get-MpPreference).MAPSReporting
    Set-MpPreference -DisableRealtimeMonitoring 1
    Set-MpPreference -MAPSReporting Disabled

    Get-ChildItem -File 'C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service' -Recurse | Remove-Item -Force

    Set-MpPreference -DisableRealtimeMonitoring 0
    Set-MpPreference -MAPSReporting $MAPS_Status
}

# Create scheduled task

$TaskName = 'Clear Defender Protection History'
$SchedulerPath = '\Microsoft\Windows\PowerShell\ScheduledJobs'
Unregister-ScheduledJob $TaskName -Confirm:$false 2>&1 | Out-Null
Register-ScheduledJob -Name $TaskName -ScriptBlock $ScriptBlock | Out-Null

$adminAccount = Get-LocalUser | Where-Object {$_.SID -like "*-500"} | Select-Object -ExpandProperty Name
$Principal = New-ScheduledTaskPrincipal -UserId "$env:COMPUTERNAME\$adminAccount"
Set-ScheduledTask -TaskPath $SchedulerPath -TaskName $TaskName -Principal $Principal | Out-Null

$Service = New-Object -ComObject 'Schedule.Service'
$Service.Connect()

# Invoke task as TI

$User = 'NT SERVICE\TrustedInstaller'
$Folder = $Service.GetFolder($SchedulerPath)
$Task = $Folder.GetTask($TaskName)

$Task.RunEx($null, 0, 0, $User) | Out-Null

# Wait for task completion, or timed out

$Timeout = 60
$Timer =  [Diagnostics.Stopwatch]::StartNew()

while (((Get-ScheduledTask -TaskName $TaskName).State -ne 'Ready') -and ($Timer.Elapsed.TotalSeconds -lt $Timeout)) {
    Start-Sleep -Seconds 1
}

$Timer.Stop()

# Remove scheduled task
Unregister-ScheduledJob $TaskName -Confirm:$false | Out-Null

Click to expand...

LesFerch said:

Script revised:

ClearDefenderHistory

Clear Windows Defender History Files

lesferch.github.io

@Steve C Please try this new version. Thanks!

Click to expand...

LesFerch said:

Script revised:

ClearDefenderHistory

Clear Windows Defender History Files

lesferch.github.io

@Steve C Please try this new version. Thanks!

Click to expand...

Tester said:

Tested clean win 11 vm with:
Defender version; 4.18.24030.9-0
Windows 11 version: 23H2 OS build: 22631.3527
Works Like a Charm!

Click to expand...

Tester said:

How did you figure out so fast how that that other program did it this way?

Click to expand...

Tester said:

After running it on some more machines, i have noticed one more thing about the script.
If i double click the file, UAC elevation prompt comes up, then a black screen flashes.
So i guess, this part of the scrips fails, and hits the goto :eof and so skipping the rest of the script.
Right click and run as administrator works.

Click to expand...

LesFerch said:

But it sounds like you're getting the reboot prompt when using "Run as Administrator", but not when double-clicking. Is that correct and is that consistent for all your machines?

Click to expand...

Tester said:

Yes, with right click run as admin, i get the reboot prompt, so the log file is detected.
All machines where i have run the script, where windows machines with the same 23H2 updates.
I will boot up later today, some old cloned machines that are update until jan/febr or even later. Do you also want to know it for windows 10?

Click to expand...

garlin said:

I think to debug what's happening for @Tester, we change -ArgumentList '/c %~dpnx0 %*' to '/k %~dpnx0 %*'.

Click to expand...

Tester said:

I know from tools that impersonate trusted installers etc. Like: RunAsTI64, ExecTI, Advanced Run x64, That two depency's are needed for those to run correctly.
Modules installer, and Secondary Login.
Any dependency's that i can check for this script?

Click to expand...

Steve C said:

I'm impressed by all this sophisticated script writing but why don't you folks simply delete the Defender history folder at
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service using Safe Mode which still works?

Click to expand...