question

Over a 24 hour period we ended up with roughly 950,000 files and it was taking 30 GB of space.

It is an abnormal phenomenon, please execute a full scan with Windows Defender, then delete the Scans History Files.

Don’t worry, I ever deleted all files in C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store on my windows 10 to see what would happen, defender still appears to be working fine.

Windows defender files will appear in disk clean up if you click the clean up system files

If the Answer is helpful, please click "Accept Answer" and upvote it.
Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

We started having this same problem on our WS 2016 Domain Controller.

It normally takes 20minutes to backup this server, but last night it hit runtime limit of 4hours and the cause was tracked down to be over 200k new files in C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store.

It looks to be the system process that is creating these random 1KB to 2KB files in said locate, this is an assumption as the owner of the files is System and in Ressource Monitor>Disk I can see the System process accessing said folder location.

Since 22:11 last night it has been creating hundreds of thousands of these files and it continues to do so after a reboot.

Windows Defender GUI isn't running a scan, doesn't show anything in History.

Windows Defender Operations log in EventViewer does indicate why these random files are being created.

What is the C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\ folder for?
How do I determine what is constantly creating these files?

We have the same Problem on different Servers with 2016! Any News?

One of my Windows 2019 std Server is having the same symptom.
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\ contains several millions 1-2kb files and the MsMpEng.exe process is running at 60%-90% all the time.
Not sure if I can delete the "Store" folder or not?

Seeing this issue on our 2012R2 file servers.
C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Store has millions of these 1-2kb files.
We had to delete the entire Store folder and haven't seen any issues thus far.

We're seeing this too, it's a thing.

We've begun to see this pop up more and more this past week without explanation. Even after uninistalling WD, the files still exist. We've had to take ownership of C:\ProgramData\Microsoft\Windows Defender\Scans which (depending on the size) may take hours. Then we delete the C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store folder to recover space. All servers so far have been 2016, though we're not ruling out 2019, as well. This appears to be a WD issue rather than an OS issue.

I'm having the same issue on our file server. Trying to delete the store folder but its taking "forever" even when using powershell!

I have heard that this issue is caused if you have more than one AV running on the server. Disabling Windows Defender fixes it (if you have another AV installed)

Windows Defender Engineer.

----Issue----
Large files generated inside the folder c:/programdata/microsoft/windowsdefender/scan/history

----Clarification----

This issue is current a known issue and the fix will be hit all release ring in this Thursday. The RCA is Engineer of MsMpEng.dll has some issue and causing lots of files in this folder. The affected engine version is 18100.5.

The update will take the normal release cycle and will hit mainstream this Thursday.

Release schedule:

R1: Friday (4/30)
R2: Monday (5/3)
R3: Tuesday (5/4)
Release: Thursday (5/6)

You can update the engine version by installing the signature update using your regular method(SCCM, WSUS...) or the offline update package(Latest security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware - Microsoft Security Intelligence).