Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. winevt
  5. Logs
  6. Microsoft-Windows-Windows Defender%4Operational.evtx
LogRisk: Caution

Microsoft-Windows-Windows Defender%4Operational.evtx C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx

Windows Defender/Operational log: detections (1116, 1117), signature updates (2000, 2001) and real-time protection state (5001).

Updated on By AltF4 Formation

What it’s for

The Microsoft-Windows-Windows Defender/Operational channel is the activity log of Microsoft Defender Antivirus: threats detected, action taken, signature status, protection being turned off. It exists on clients and on Windows Server as long as Defender is installed.

What it contains

  • 1116: malware or unwanted software detected (threat name, path, user, process).
  • 1117: action taken to protect the machine (quarantine, removal).
  • 1118 and 1119: action failed, or critical failure.
  • 2000 and 2001: signatures updated, or signature update failed.
  • 5000 and 5001: real-time protection enabled, or disabled.
  • 5007: Defender configuration changed (adding an exclusion included).

Risks and best practices

  • A 5001 or 5007 followed by an unexpected exclusion deserves an investigation: they are the footprints of a protection bypass.
  • With Defender managed by policy, Intune or a security console, check the effective configuration with Get-MpPreference instead of inferring it from events.
  • Detected paths and file names can reveal company documents: review the export before sending it out.

Useful commands

Fenêtre de terminal
# Threats detected and actions taken
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Windows Defender/Operational'; Id=1116,1117} -MaxEvents 30 |
    Select-Object TimeCreated, Id, Message


# Failed signature updates
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Windows Defender/Operational'; Id=2001} -MaxEvents 10


# Threats known to the engine and current status
Get-MpThreatDetection | Select-Object InitialDetectionTime, ThreatID, Resources
Get-MpComputerStatus | Select-Object AMServiceEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated

Format

Binary XML file (.evtx). The “/” in the channel name becomes “%4” in the file name.

Rotation and archiving

Maximum size and behavior when full are set in the log properties or through Group Policy; wevtutil gl shows the configuration and wevtutil epl exports the log to an .evtx file.

How to read it

In Event Viewer, go to Applications and Services Logs, Microsoft, Windows, Windows Defender, Operational. Filter on 1116 and 1117 for detections, then follow 5001 and 5007 to see whether protection was changed before the incident. Engine detail (scans, updates) is in MPLog-*.log under ProgramData\Microsoft\Windows Defender\Support.

Report a mistake