Windows Defender Protection History Purge Issue

I'm trying to avoid a repeat issue if it occurs in the future. Earlier this week I noticed ancient threat history item in Windows Defender. Since Microsoft prevents you from simply deleting the Service folder and clearing it now, I tried deleting the Event Viewer Log (another online recommendation)...that didn't work. I read and followed the online recommendations to boot into Safe Mode and then delete the Service folder. I did that, logged back into Windows, and it had worked, or so I thought. I immediately noticed that several Windows functions (logging in, opening File Explorer, Opening Windows Tools, etc.) became extremely slow. I found that they were tied to Windows Defender Realtime Protection. If I turned it off, everything was fine.

I tried repairing Windows Defender from within "Apps." When that didn't work I even tried "Reset" from within Apps. That didn't work either. I did a System Restore to before I removed the files but that failed to fix the issue too. Ultimately, I ended up doing a "Repair by Reinstall" and it has worked. However, I just used Powershell to see what the purge frequency is for Windows Defender Protection History. It came back with "0" meaning it never purges. I thought I read somewhere that it is supposed to be 15 days. Can someone please confirm what the purge history time is for 23H2? Also, should I need to purge it again, and not corrupt (or whatever happened) it again, is there another safer way to purge the protection history? Admittedly, this was right after Tuesday's Windows Update so it is very possible that did it too.

I use Defender UI to clear the history list. I turn off Tamper protection first then run the clear history. It auto boots to safe mode, does the job, then select reboot. Turn on tamper protection. Works for me.

mccnavy said:

Can someone please confirm what the purge history time is for 23H2? Also, should I need to purge it again, and not corrupt (or whatever happened) it again, is there another safer way to purge the protection history?

Click to expand...

In this tutorial, @Brink says, "Protection History only retains events for 15 days by default, after which they will automatically be cleared from history."

I have found that deleting the Service folder is easy if Windows Defender isn't running. I have a little program that lets me stop Defender temporarily. It's called Defender Control, and it can be downloaded at Major Geeks:


but I don't recommend it, because it's very difficult to download and to install, because, quite naturally, Windows Defender regards it as a dangerous program (its purpose is to temporarily disable Defender) and tries to block the download, and then quarantines the program if you download it successfuly.

Another tack I might suggest, though, if the Safe Mode solution isn't working for you, is to get and install (temporarily) a third-party antivirus. When most such AV programs are running, Defender is disabled, and when Defender is not running, you can access and delete that Service folder with no problem.

Then I'd use Revo Uninstaller (Free) to uninstall the AV program and all of its leftovers, and once it's gone Defender will be back in action. And the Defender Protection History window will show "No Recent Actions."

If you think this sounds like a whole lot of trouble to get rid of a small issue, I agree completely.

@Fabler2

Thank you for suggesting that program. I hadn't heard of it, and I downloaded and installed it without incident, ran it with no problem, and was very pleased with the range of options and actions. I've kept the link for future use when visitors here need help with Defender.

Dan

Wisewiz said:

@Fabler2

Thank you for suggesting that program. I hadn't heard of it, and I downloaded and installed it without incident, ran it with no problem, and was very pleased with the range of options and actions. I've kept the link for future use when visitors here need help with Defender.

Dan

Click to expand...

Kudos goes to @Stigg for originally posting about DefenderUI. Funny that I even remembered that!

Thanks...I recently started using DefenderUI too...nice tool. I wonder if my issue was not turning off Tamper Protection before deleting the files? I'll try that for next time...hopefully I won't need to.

Is the automatic purge of Defender History broken?
I tried setting the days until purge according to the first 3 methods in this tutorial. I first tried reading the days with Powershell and it returned nil indicating automatic purge was disabled. So, per #2 in the tutorial, I set the days to 15 using Powershell. But when I read it back with Powershell it returned nil again. Using gpedit per #3 in the tutorial I set the days to 14 but again Powershell read nil for the days until purge. I rebooted in case this was needed but it didn't help. It seems like the methods given in the turorial no longer activate the automatic purge of Defender History.

GadgetBuilder said:

Is the automatic purge of Defender History broken?
I tried setting the days until purge according to the first 3 methods in this tutorial. I first tried reading the days with Powershell and it returned nil indicating automatic purge was disabled. So, per #2 in the tutorial, I set the days to 15 using Powershell. But when I read it back with Powershell it returned nil again. Using gpedit per #3 in the tutorial I set the days to 14 but again Powershell read nil for the days until purge. I rebooted in case this was needed but it didn't help. It seems like the methods given in the turorial no longer activate the automatic purge of Defender History.

Click to expand...

The 15 day timeout appears wrong. I have a warning about a potentially unwanted app dated 12th March which hasn't been delteed after 32 days.