MPLog-<AAAAMMJJ>-<HHMMSS>.log C:\ProgramData\Microsoft\Windows Defender\Support\MPLog-<AAAAMMJJ>-<HHMMSS>.log

MPLog-*.log: detailed diagnostic logs of the Microsoft Defender Antivirus engine (scans, detections, exclusions, ASR rules), used for troubleshooting.

Updated on 12 November 2026 By AltF4 Formation

What it’s for

The MPLog-*.log files are the detailed diagnostic logs of the Microsoft Defender Antivirus engine. You open them when a detection, a scan, an exclusion or an attack surface reduction (ASR) rule does not behave as expected, and Microsoft’s ASR troubleshooting guide points to them. For routine monitoring, the Microsoft-Windows-Windows Defender/Operational event log is a better fit.

What it contains

Time-stamped lines describing engine activity: files and processes scanned, detection decisions, exclusions applied, engine and signature updates. The file name carries the creation date and time (MPLog-YYYYMMDD-HHMMSS.log). Verbosity and fields are not fixed and can change with the platform version.

Risks and best practices

The logs contain paths, process names and sometimes user names, so anonymize them before sharing.
The service manages them itself and they are your trail after an incident. Copy them elsewhere instead of purging them.
To send traces to Microsoft support, collect them with MpCmdRun.exe -GetFiles: it builds an MpSupportFiles.cab archive in the same Support folder.
For day-to-day detection, query the event log (ID 1116 for a detected threat, 1117 for the action taken) or Get-MpThreatDetection.

Useful commands

# MPLog files, newest first
Get-ChildItem "$env:ProgramData\Microsoft\Windows Defender\Support\MPLog-*.log" |
    Sort-Object LastWriteTime -Descending | Select-Object Name, Length, LastWriteTime

# Search for a keyword (for example a file name or an ASR rule)
Select-String -Path "$env:ProgramData\Microsoft\Windows Defender\Support\MPLog-*.log" -Pattern 'Asr'

# Collect the logs for support (creates MpSupportFiles.cab in the Support folder)
& "$env:ProgramFiles\Windows Defender\MpCmdRun.exe" -GetFiles

# Recent detections in the event log
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-Windows Defender/Operational'; Id = 1116, 1117 } -MaxEvents 20

Format

Plain text, one entry per line, time-stamped.

Rotation and archiving

Defender creates new files over time and automatically removes the oldest ones. To keep a history, copy the files to central storage.

How to read it

Open the file in an editor, or use Get-Content and Select-String. Search for the name of the file or rule involved, then read the surrounding lines to see the decision taken.

Report a mistake