This post shows student and new users steps to access and monitor actions taken by Windows Security App on the Protection History page in Windows 11.
The Protection History page in the Windows Security app is where you can view actions that Microsoft Defender Antivirus has taken, including Potentially Unwanted Apps that have been removed or critical services that are turned off.
If you need to view and monitor what security actions are taken by Microsoft Defender Antivirus, go to the Protection History page. In addition, you’ll see the latest protection actions and recommendations from the Windows Security app.
Events are shown as a series of cards in the protection history. If a card needs your attention, you will see one of two colored badges on the card’s icon.
- Red – This is a serious item that requires immediate attention.
- Yellow – This item is not urgent, but should be checked when you can.
Protection History only retains events for two weeks, after which they disappear from this page.
How to see actions taken by Microsoft Defender in Windows 11
As mentioned above, the Protection History page in the Windows Security app is where you can view actions that Microsoft Defender Antivirus has taken, including Potentially Unwanted Apps that have been removed or critical services that are turned off.
To get the Microsoft Defender Protect History page, follow the steps below:
In the search box on the taskbar, type Windows Security and select Windows Security in the results list.
In Windows Security, select Protect history link on the left or the Protection history tile, as highlighted in the image below.
On the Protection history page, you should view the latest actions taken by Microsoft Defender and other recommendations.
Again, Protection History only retains events for two weeks, after which they disappear from this page.
You can use the Filters options to filter the Protection history.
If Microsoft Defender Antivirus detects a piece of malware, it will be recorded in Protection History under Malware alerts.
Below are the different actions that you’ll find in Protection history.
Threat found – action needed
This indicates that Microsoft Defender Antivirus has detected a possible threat and needs you to decide how to handle it.
When you select the Actions dropdown, you’ll find options to Quarantine or Allow on the device.
This indicates that the threat has been blocked and quarantined and hasn’t been removed.
There are two actions you can take:
- Remove – This removes the threat from your device.
- Restore – This puts the file back on your device where Defender will again detect it as a threat and create a new Threat found – action needed item in Protection History.
This indicates that Defender has blocked and removed a threat on your device.
Potentially unwanted apps (PUA)
Potentially unwanted applications are a category of software that can cause your machine to run slowly, display unexpected ads, or, at worst, install other software which may be more harmful or annoying.
This app has been blocked
Microsoft Defender SmartScreen can block potentially unwanted apps before they’re installed, and if that happens, you’ll see a blocked event in the Protection History.
That should do it!
This post showed you how to view actions taken by the Microsoft Security app in Windows 11. Please use the comment form below if you find any errors above or have something to share.