Restore quarantined files in Windows Defender AV

Applies to:

If Windows Defender Antivirus is configured to detect and remediate threats on your device, Windows Defender Antivirus quarantines suspicious files. If you are certain these files do not present a threat, you can restore them.

  1. Open Windows Security.
  2. Click Virus & threat protection and then click Threat History.
  3. Under Quarantined threats, click See full history.
  4. Click an item you want to keep, then click Restore. (If you prefer to remove the item, you can click Remove.)


You can also use the dedicated command-line tool mpcmdrun.exe to restore quarantined files in Windows Defender AV.