Windows Defender C:\ProgramData\Microsoft\Windows Defender

Microsoft Defender Antivirus data: definitions, platform versions, quarantine and scan results. Do not edit by hand.

Updated on 12 November 2026 By AltF4 Formation

What it’s for

Microsoft Defender Antivirus keeps its definitions, platform versions, quarantine and scan histories here. The Windows Security app shows this data (quarantined threats, protection history, protection updates), so you rarely need to open the folder. The antimalware platform is installed under Platform\<version>, which is where the MpCmdRun.exe command-line tool runs from.

What it contains

Definition Updates: the definitions (signatures) downloaded by protection updates.
Platform: one subfolder per antimalware platform version, with MpCmdRun.exe.
Quarantine: files isolated after detection, encrypted.
Scans and History: results and history of scans and detections.

Risks and best practices

Do not clean this folder by hand: you risk corrupting the antivirus, losing the quarantine or disabling protection. Defender purges its own old definitions.
Quarantine and Scans cannot be opened without the SYSTEM account, even by an administrator, and tamper protection reinforces the lock. Manage quarantine through the Windows Security app or with Get-MpThreat and Remove-MpThreat.
Do not add this folder to scan exclusions: malware could settle in it unseen.

Useful commands

# Antivirus status and definitions date
Get-MpComputerStatus | Select-Object AMProductVersion, AntivirusSignatureVersion, AntivirusSignatureLastUpdated

# Installed platform versions
Get-ChildItem "$env:ProgramData\Microsoft\Windows Defender\Platform" -Directory | Select-Object Name

# Detected threats and configured exclusions
Get-MpThreat
(Get-MpPreference).ExclusionPath

# Update definitions (as administrator)
Update-MpSignature

Folder contents

Folders 1

SupportDiagnostic logs of the Microsoft Defender Antivirus engine (MPLog-*.log); collect them…

Report a mistake