How to Change Windows 11 Security Event Retention
Adjusting the retention period for Windows Security Protection history in Windows 11 keeps security logs around longer than the default 15 days.
Change Windows 11 security event retention by opening PowerShell as administrator. Use the command Set-MpPreference -ScanPurgeItemsAfterDelay , replacing with your desired retention period. This adjusts how long Windows Defender keeps a record of past security events.
Understanding 🪟 Windows 11 Protection History
Windows 11 Protection history shows what Microsoft Defender Antivirus has done to keep your computer safe, such as blocking unwanted apps or quarantining suspicious files.
Why check your Protection History?
The Security Event log shows whether your antivirus detected recent threats. This event log helps you understand if a downloaded program was blocked or if a dangerous-looking file was moved to quarantine.
What happens when you review it?
The Windows Defender quarantine list helps you identify false positives. False positives happen when Windows Defender flags a safe file as malicious by mistake. Reviewing this list lets you restore safe files that were caught in the crossfire.
Quarantined vs. Blocked vs. Remediated
| Status | Meaning |
|---|---|
| Quarantined | The file is moved to a safe folder so it cannot run. |
| Blocked | The app or action was stopped before it could start. |
| Remediated | The threat was cleaned or deleted by the antivirus. |
How to Change 🪟 Windows 11 Security Event Retention
Windows 11 security event logs track your computer's security activity. By default, Windows 11 keeps these security event logs for 15 days. PowerShell commands let you change the retention period for these security event logs. Modifying this timeframe lets you decide how much security history you want to save for later review.
- Open the Start menu and search for PowerShell.
- Right-click it and select Run as administrator.
- To see your current setting, type the following command and press Enter:
Get-MpPreference | Select-Object -Property ScanPurgeItemsAfterDelay
The default value is 15. The following command format changes the number of days:
Set-MpPreference -ScanPurgeItemsAfterDelay <days>
Replace <days> with your preferred number. For example, typing this command keeps records for 100 days:
Set-MpPreference -ScanPurgeItemsAfterDelay 100
How to Manually Clear Protection History
Manually clearing your Windows 11 protection history requires deleting files in a specific folder. This process removes the recorded history without getting rid of any actual threats that Windows Defender found. Administrator rights are required for this action.
Clearing the history manually requires deleting the contents of the detection folder. Administrator privileges are necessary for this step.
- Open File Explorer and navigate to:
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory - You may need to enable 'Hidden items' in the View menu to see the
ProgramDatafolder. - Delete all files inside the
DetectionHistoryfolder.
Summary
Windows 11 Protection history helps you monitor security events. The Set-MpPreference command in PowerShell changes how long these logs remain on the system. Visit the official Microsoft Support website for more information on managing security.
Why does Windows keep showing old threats in Protection History?
Windows keeps these records to maintain an audit trail of past security events. Default settings clear out this data every 15 days. High retention numbers or an uncleared automatic purge date explain why old threats sometimes remain visible.
Is it safe to delete the Protection History folder?
Deleting the contents of the DetectionHistory folder is safe. This action only clears the visual log of past events in the Windows Security app. Computer security status remains unaffected, and active threats currently under management stay contained.
Does clearing history remove the actual virus?
Clearing the Protection history does not remove actual viruses or malware. The history functions as a list of past actions rather than the threat itself. Quarantined or remediated files are already neutralized. Wiping the list removes the record of that event from view.
Was this guide helpful?
About the Author
Richard
Tech Writer, IT Professional
Richard, a writer for Geek Rewind, is a tech enthusiast who loves breaking down complex IT topics into simple, easy-to-understand ideas. With years of hands-on experience in system administration and enterprise IT operations, he’s developed a knack for offering practical tips and solutions. Richard aims to make technology more accessible and actionable. He's deeply committed to the Geek Rewind community, always ready to answer questions and engage in discussions.
No comments yet — be the first to share your thoughts!