Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. ProgramData
  3. Microsoft
  4. Windows Defender
  5. Support
FolderRisk: Caution

Support C:\ProgramData\Microsoft\Windows Defender\Support

Diagnostic logs of the Microsoft Defender Antivirus engine (MPLog-*.log); collect them with MpCmdRun.exe -GetFiles for support.

Updated on By AltF4 Formation

What it’s for

The Microsoft Defender Antivirus engine writes its diagnostic files here. You read them to understand why a file was blocked, why a scan fails or how an attack surface reduction rule applied, or to hand traces to support.

What it contains

The text logs of the antimalware service, including the MPLog-*.log files (see the dedicated page). Their exact name and number vary with the Defender platform version. For day-to-day activity, the Microsoft-Windows-Windows Defender/Operational event log in Event Viewer is easier to read.

Risks and best practices

  • The service manages these files and they support investigations after an incident, so do not delete them to “clean up”.
  • They mention file paths, user names and processes. Review them before sending them to a third party.
  • To gather logs for support, run MpCmdRun.exe -GetFiles instead of copying files by hand.

Useful commands

Fenêtre de terminal
# Collect logs for support (as administrator)
& "$env:ProgramFiles\Windows Defender\MpCmdRun.exe" -GetFiles


# Antivirus status and engine version
Get-MpComputerStatus | Select-Object AMServiceEnabled, AntivirusEnabled, AMEngineVersion

Folder contents

Logs 1

Report a mistake