Windows Defender issue on server - lots of files being created

Question

question

ITResourcing-6032 asked Apr 29, '21 sarfarazshaikh-7374 commented Feb 23, '22

Windows Defender issue on server - lots of files being created

We have an issue on a Windows Server 2019 Datacenter virtual machine with Windows Defender.
We are in: Settings -> Update & Security -> Windows Security -> Virus & threat protection -> Virus & threat protection settings -> Manage settings

When Real-time protection is turned on, after about 20-30 minutes it creates hundreds/thousands of files in this location:
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store

Most of these files are either 1kb or 2kb. Over a 24 hour period we ended up with roughly 950,000 files and it was taking 30 GB of space. This does not appear to be normal. There is no threats detected and no actively running scan or updates. These files appear to be encrypted, or at least we can't open them in notepad and see any useful data. This is only happening on one server.

Anybody got any ideas?

windows-server

· 2

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

TomDingShanghaiWicresoftCoLtd-3099 · May 04, 2021 at 06:19 AM

The affected engine version is 18100.5.
The fixed engine version is 18100.6.

0 ·

sarfarazshaikh-7374 · Feb 23 at 09:12 AM

C:\Program Files\Windows Defender>MpCmdRun.exe -SignatureUpdate

0 ·

image.png (25.3 KiB)

Answer 1 · 2021-04-29T07:03:19.7Z

TeemoTang-MSFT answered Apr 29, '21 DenisPayne-4809 commented May 4, '21

Over a 24 hour period we ended up with roughly 950,000 files and it was taking 30 GB of space.

It is an abnormal phenomenon, please execute a full scan with Windows Defender, then delete the Scans History Files.

Don’t worry, I ever deleted all files in C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store on my windows 10 to see what would happen, defender still appears to be working fine.

Windows defender files will appear in disk clean up if you click the clean up system files

If the Answer is helpful, please click "Accept Answer" and upvote it.
Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

· 3

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

DenisPayne-4809 · Apr 30, 2021 at 08:38 AM

Issue is happening on a 2nd WS 2016 VM, can anyone advise on how to diagnose this?

0 ·

TomDingShanghaiWicresoftCoLtd-3099 · May 04, 2021 at 06:14 AM

You can safely delete the history folder.

----Issue----
Large files generated inside the folder c:/programdata/microsoft/windowsdefender/scan/history

----Clarification----

This issue is current a known issue and the fix will be hit all release ring in this Thursday. The RCA is Engineer of MsMpEng.dll has some issue and causing lots of files in this folder. The affected engine version is 18100.5.

The update will take the normal release cycle and will hit mainstream this Thursday.

Release schedule:

R1: Friday (4/30)
R2: Monday (5/3)
R3: Tuesday (5/4)
Release: Thursday (5/6)

You can update the engine version by installing the signature update using your regular method(SCCM, WSUS...) or the offline update package(Latest security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware - Microsoft Security Intelligence).

0 ·

DenisPayne-4809 TomDingShanghaiWicresoftCoLtd-3099 · May 04, 2021 at 10:32 AM

Will running update from Windows Defender once the fix is out not resolve the issue?

How about using Windows Updates?

We don't use SCCM nor WSUS.

0 ·

Answer 2 · 2021-04-29T14:03:16.593Z

DenisPayne-4809 answered Apr 29, '21 TomDingShanghaiWicresoftCoLtd-3099 commented May 4, '21

We started having this same problem on our WS 2016 Domain Controller.

It normally takes 20minutes to backup this server, but last night it hit runtime limit of 4hours and the cause was tracked down to be over 200k new files in C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store.

It looks to be the system process that is creating these random 1KB to 2KB files in said locate, this is an assumption as the owner of the files is System and in Ressource Monitor>Disk I can see the System process accessing said folder location.

Since 22:11 last night it has been creating hundreds of thousands of these files and it continues to do so after a reboot.

Windows Defender GUI isn't running a scan, doesn't show anything in History.

Windows Defender Operations log in EventViewer does indicate why these random files are being created.

What is the C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\ folder for?
How do I determine what is constantly creating these files?

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

TomDingShanghaiWicresoftCoLtd-3099 · May 04, 2021 at 06:16 AM

----Issue----
Large files generated inside the folder c:/programdata/microsoft/windowsdefender/scan/history

----Clarification----

This issue is current a known issue and the fix will be hit all release ring in this Thursday. The RCA is Engineer of MsMpEng.dll has some issue and causing lots of files in this folder. The affected engine version is 18100.5.

The update will take the normal release cycle and will hit mainstream this Thursday.

Release schedule:

R1: Friday (4/30)
R2: Monday (5/3)
R3: Tuesday (5/4)
Release: Thursday (5/6)

You can update the engine version by installing the signature update using your regular method(SCCM, WSUS...) or the offline update package(Latest security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware - Microsoft Security Intelligence).

0 ·

Answer 3 · 2021-05-02T11:50:47.283Z

AndreasSchweizerdivertogmbh-8979 answered May 2, '21

We have the same Problem on different Servers with 2016! Any News?

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 4 · 2021-05-03T09:15:40.517Z

AxeliusCarl-3418 answered May 3, '21

One of my Windows 2019 std Server is having the same symptom.
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\ contains several millions 1-2kb files and the MsMpEng.exe process is running at 60%-90% all the time.
Not sure if I can delete the "Store" folder or not?

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 5 · 2021-05-03T14:26:13.033Z

HaggertyJohn-9822 answered May 3, '21

Seeing this issue on our 2012R2 file servers.
C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Store has millions of these 1-2kb files.
We had to delete the entire Store folder and haven't seen any issues thus far.

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 6 · 2021-05-03T17:28:06.923Z

PaulMolina-6901 answered May 3, '21

We're seeing this too, it's a thing.

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 7 · 2021-05-03T18:09:37.377Z

MWheeler-9259 answered May 3, '21 IndyPilot-1135 published May 3, '21

We've begun to see this pop up more and more this past week without explanation. Even after uninistalling WD, the files still exist. We've had to take ownership of C:\ProgramData\Microsoft\Windows Defender\Scans which (depending on the size) may take hours. Then we delete the C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store folder to recover space. All servers so far have been 2016, though we're not ruling out 2019, as well. This appears to be a WD issue rather than an OS issue.

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

IndyPilot-1135 · May 03, 2021 at 10:21 PM

Can confirm it's happening on 2019 with 3rd party AV installed.

0 ·

Answer 8 · 2021-05-03T18:36:53.09Z

dubsdj-1606 answered May 3, '21 DustinG-8150 commented May 3, '21

I'm having the same issue on our file server. Trying to delete the store folder but its taking "forever" even when using powershell!

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

DustinG-8150 · May 03, 2021 at 06:56 PM

We had 12 million files in C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Store.
Weirdly when we did a Remove-item it did not work and just sat for hours but when doing a "shift + delete" on the folder it worked after an hour or so. It is saying it will take more than a day to delete....

1 ·

Answer 9 · 2021-05-03T23:22:47.323Z

dubsdj-1606 answered May 3, '21

I have heard that this issue is caused if you have more than one AV running on the server. Disabling Windows Defender fixes it (if you have another AV installed)

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 10 · 2021-05-04T06:13:21.263Z

TomDingShanghaiWicresoftCoLtd-3099 answered May 4, '21 Fabian-7704 commented May 4, '21

Windows Defender Engineer.

----Issue----
Large files generated inside the folder c:/programdata/microsoft/windowsdefender/scan/history

----Clarification----

This issue is current a known issue and the fix will be hit all release ring in this Thursday. The RCA is Engineer of MsMpEng.dll has some issue and causing lots of files in this folder. The affected engine version is 18100.5.

The update will take the normal release cycle and will hit mainstream this Thursday.

Release schedule:

R1: Friday (4/30)
R2: Monday (5/3)
R3: Tuesday (5/4)
Release: Thursday (5/6)

You can update the engine version by installing the signature update using your regular method(SCCM, WSUS...) or the offline update package(Latest security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware - Microsoft Security Intelligence).

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Fabian-7704 · May 04, 2021 at 08:54 AM

@TomDingShanghaiWicresoftCoLtd-3099 what is the version number of the fixed engine? This would help us to identify the fixed installation

0 ·

question