How to Change Windows 11 Security Event Retention
Keep your Windows 11 security logs longer than the default 15-day limit by changing the retention period for Windows Security Protection history. This guide shows how to check the current value, change it, and clear the history by hand if you need to.
Open PowerShell as administrator and run Get-MpPreference | Select-Object -Property ScanPurgeItemsAfterDelay to check the current retention period for Protection history. Change it with Set-MpPreference -ScanPurgeItemsAfterDelay followed by the number of days you want, such as 100 for 100 days. The change takes effect immediately.
Understanding 🪟 Windows 11 Protection History
Windows Protection history shows what Microsoft Defender Antivirus has done to keep your computer safe, such as blocking unwanted apps or quarantining suspicious files. You can open it from the Windows Security app. Items older than the retention period are removed, so a longer period means you can look further back.
Why check your Protection History?
The Security Event log shows whether your antivirus detected recent threats. This event log helps you understand if a downloaded program was blocked or if a dangerous-looking file was moved to quarantine. If something odd happened a few weeks ago, this is where you look. With the default retention, that entry may already be gone.
What happens when you review it?
The Windows Defender quarantine list helps you identify false positives. False positives happen when Windows Defender flags a safe file as malicious by mistake. Reviewing this list lets you restore safe files that were caught in the crossfire. Check it before the retention period runs out, because quarantined items are cleared after that time.
Quarantined vs. Blocked vs. Remediated
| Status | Meaning |
|---|---|
| Quarantined | The file is moved to a safe folder so it cannot run. |
| Blocked | The app or action was stopped before it could start. |
| Remediated | The threat was cleaned or deleted by the antivirus. |
How to Change 🪟 Windows 11 Security Event Retention
Windows 11 security event logs track your computer's security activity. By default, Windows 11 keeps these security event logs for 15 days. PowerShell commands let you change the retention period for these security event logs. Modifying this timeframe lets you decide how much security history you want to save for later review.
The steps are the same on Windows 11 Home and Pro, because they use PowerShell and not Group Policy.
- Open the Start menu and search for PowerShell.
- Right-click it and select Run as administrator. If a User Account Control prompt appears, click Yes. A PowerShell window opens with “Administrator” in the title bar.
- To see your current setting, type the following command and press Enter:
Get-MpPreference | Select-Object -Property ScanPurgeItemsAfterDelay
The default value is 15, which is the number of days Windows keeps the history. If you see a different number, someone has already changed it on this PC, or a policy has set it. The following command format changes the number of days:
Set-MpPreference -ScanPurgeItemsAfterDelay <days>
Replace <days> with your preferred number. For example, typing this command keeps records for 100 days:
Set-MpPreference -ScanPurgeItemsAfterDelay 100
To confirm it, run the first command again and check that the new number is shown. To undo the change, run the same command format with 15 as the number. Keep in mind that a longer period means more history stored on disk, though the amount is small on most PCs.
How to Manually Clear Protection History
Manually clearing your Windows 11 protection history requires deleting files in a specific folder. This process removes the recorded history without getting rid of any actual threats that Windows Defender found. Do this only if you want a clean history, because deleted entries cannot be brought back.
Clearing the history manually requires deleting the contents of the detection folder. Administrator privileges are required for this step.
- Open File Explorer and navigate to:
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory - You may need to enable 'Hidden items' in the View menu to see the
ProgramDatafolder. In Windows 11, click View Show Hidden items. The folder should now appear in the list. - Delete all files inside the
DetectionHistoryfolder. Delete the files only, not the folder itself. If Windows asks for administrator permission, click Continue.
Open Windows Security and check Protection history afterwards. The old entries should be gone. If a file will not delete, close the Windows Security app and try again.
Summary
Windows 11 Protection history helps you monitor security events. The Set-MpPreference command in PowerShell changes how long these logs remain on the system. Visit the official Microsoft Support website for more information on managing security.
Have a question about this guide?
Answered by AI from this guide. Good questions may be added to this page — please don't include personal details.
Did this guide fix your problem?
About the Author
Richard
Tech Writer, IT Professional
Richard is a writer at Geek Rewind who turns complex IT tasks into clear, step-by-step guides. He draws on years of hands-on experience in system administration and enterprise IT operations, focusing on Windows, Linux and WordPress: the problems people actually run into, and the fixes that work. His server and WordPress guides come from systems he runs himself. Richard builds and maintains the platform behind Geek Rewind, from its Ubuntu servers and Nginx configuration to its custom WordPress plugins. Many new tutorials start with readers' questions, and he's always glad to answer them in the comments.
No comments yet — be the first to share your thoughts!