How to Change Windows 11 Security Event Retention

This guide explains how to change how long Windows Security Protection history keeps a record of your past security events on Windows 11.

Understanding Windows 11 Protection History

Windows 11 Protection history is a built-in log that shows you what Microsoft Defender Antivirus has been doing to keep your computer safe. It tracks actions like blocking Potentially Unwanted Apps (PUA), quarantining suspicious files, and stopping malicious services. Think of it as a security diary for your PC.

Why check your Protection History?

You check this history to see if your antivirus has caught any threats recently. It helps you understand if a program you downloaded was blocked or if a file was moved to quarantine because it looked dangerous.

What happens when you review it?

Reviewing this list helps you spot false positives. A false positive happens when Windows Defender thinks a safe file is a virus. If you see something you know is safe, you can restore it from the quarantine list.

Quarantined vs. Blocked vs. Remediated

How to Change Windows 11 Security Event Retention

By default, Windows keeps these records for 15 days. You can change this using PowerShell.

Note: You must have administrator privileges to perform these steps.

1. Open the Start menu and search for PowerShell.
2. Right-click it and select Run as administrator.
3. To see your current setting, type the following command and press Enter:

Get-MpPreference | Select-Object -Property ScanPurgeItemsAfterDelay

The default value is 15. To change the number of days, use this command format:

Set-MpPreference -ScanPurgeItemsAfterDelay <days>

Replace <days> with your preferred number. For example, to keep records for 100 days, type:

Set-MpPreference -ScanPurgeItemsAfterDelay 100

How to Manually Clear Protection History

Warning: Always back up your system before modifying system folders. Deleting these files will remove your visible history, but it does not remove the actual viruses or threats from your computer. The actual threats are already handled by the Windows Defender Service.

To clear the history manually, you must delete the contents of the detection folder. This requires administrator privileges.

1. Open File Explorer and navigate to: C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory
2. You may need to enable ‘Hidden items’ in the View menu to see the ProgramData folder.
3. Delete all files inside the DetectionHistory folder.

Summary

Windows 11 Protection history helps you monitor security events. You can change how long these logs are kept using the Set-MpPreference command in PowerShell. For more information on managing security, visit the official Microsoft Support website.” }