The Protection History page in the Windows Security app is where you can go to view actions that Microsoft Defender Antivirus has taken that include, including Potentially Unwanted Apps that have been removed, or key services that are turned off. If you need to view and monitor what security actions are taken by Microsoft Defender Antivirus, you need to go to the Protection History page. There you’ll see the latest protection actions and recommendations from the Windows Security app. Events are shown as a series of cards in the protection history. If a card needs your attention you will see one of two colored badges on the card’s icon.
Red – This is a serious item that requires immediate attention. Yellow – This item is not urgent, but should be checked when you can.
Protection History only retains events for two weeks, after which they’ll disappear from this page.
How to see actions taken by Microsoft Defender in Windows 11
As mentioned above, the Protection History page in the Windows Security app is where you can go to view actions that Microsoft Defender Antivirus has taken that include, including Potentially Unwanted Apps that have been removed, or key services that are turned off. To get the Microsoft Defender Protect History page, follow the steps below: In the search box on the taskbar, type Windows Security and then select Windows Security in the list of results. In Windows Security, select Protect history link on the left or the Protection history tile as highlighted in the image below. On the Protection history page, you should view the latest actions taken by Microsoft Defender and other recommendations. Again, Protection History only retains events for two weeks, after which they’ll disappear from this page. You can use the Filters options to filter the Protection history. If Microsoft Defender Antivirus detects a piece of malware it will be recorded in Protection History under Malware alerts. Below are the different actions that you’ll find in Protection history.
Threat found – action needed
This indicates that Microsoft Defender Antivirus has detected a possible threat and needs you to decide on how to handle it. When you select the Actions dropdown, you’ll find options to Quarantine or Allow on the device.
Threat quarantined
This indicates that the threat has been blocked and quarantined and hasn’t been removed. There are two actions you can take:
Remove – This removes the threat from your device. Restore – This puts the file back on your device where Defender will once again detect it as a threat and create a new Threat found – action needed item in Protection History.
Threat blocked
This indicates that Defender has blocked and removed a threat on your device.
Potentially unwanted apps (PUA)
Potentially unwanted applications are a category of software that can cause your machine to run slowly, display unexpected ads, or at worst, install other software which may be more harmful or annoying.
This app has been blocked
Microsoft Defender SmartScreen can block potentially unwanted apps before they’re installed and if that happens you’ll see a blocked event in the Protection History. That should do it! Conclusion: This post showed you how to view actions taken by the Microsoft Security app in Windows 11. If you find any error above or have something to share, please use the comment form below.
