How to Clear Windows Security Protection History Logs Manually

Step-by-Step Guide: How to Clear Protection History Manually

The instructions below are split into three phases: turning off Tamper Protection, finding and deleting the log files, and turning your security features back on. The steps are the same on Windows 11 and Windows 10 unless a note says otherwise. Do all three phases in one sitting so your PC is not left with a protection setting off.

Check two limits before you start. A PC managed by an organization through Intune or Group Policy may not let you turn Tamper Protection off, because the administrator controls that setting. Also, if you use third-party antivirus software, it can change what the Windows Security pages show, and the Tamper Protection option may be missing or locked.

You may not need the manual method at all. The Protection history page in Windows Security (Windows Security › Virus & threat protection › Protection history) lets you clear individual items, and Windows removes old entries on its own over time. For the Defender operational log, open Event Viewer, go to Applications and Services Logs › Microsoft › Windows › Windows Defender › Operational, right-click it, and choose Clear Log. That clears the event log only, not the detection files in the Service folder.

Phase 1Temporarily Turn Off Tamper Protection

Tamper Protection is the setting that blocks changes to your security files, including the history logs. Windows leaves it on by default, so you must switch it off in the Windows Security app before you can delete anything. It is available in both Home and Pro editions. On current Windows 11, the Service folder is often protected even with Tamper Protection off, so some files may still be refused.

If the switch is greyed out, or a message says some settings are managed by your organization, a work or school administrator controls your PC. In that case you cannot change it yourself and need to ask your IT department.

1. Click the Start button on your taskbar🖥️, type Windows Security, then press Enter. The Windows Security window opens.

2. In the Windows Security window, click Virus & threat protection on the left side of the screen. The main protection page appears on the right.
3. Look under the Virus & threat protection settings heading and click the Manage settings link. The list of protection switches appears.

4. Scroll down until you find the setting called Tamper Protection.

5. Click the switch to turn it Off. A User Account Control window may pop up asking if you want to allow this app to make changes to your device. Click Yes. The switch should now show Off, and Windows may display a warning that your device is vulnerable. That is expected for now.

That’s it for Phase 1. Tamper Protection is now off, so the history files are unlocked. Keep the warning above in mind and move on to Phase 2 without delay.

Phase 2Locate and Delete the History Files

With Tamper Protection off, you can open the folder where Windows stores past threat logs and delete the contents. These folders sit on your main drive and are hidden by default, so you may need to turn on hidden items first.

1. Open File Explorer📁 by clicking the folder icon on your taskbar🖥️ or by pressing Win+E on your keyboard.

2. Click your main hard drive, which is usually called Local Disk (C:). If you do not see it, click This PC in the left pane first.
3. Go to the following folder path: 📁C:\ProgramData\Microsoft\Windows Defender\Scans\Historycopy. If you cannot see the ProgramData folder, click the View menu at the top of File Explorer📁, select Show, and click Hidden items so it has a check mark. On Windows 10, Hidden items is a check box on the View tab itself. The ProgramData folder should now appear, slightly faded.
4. Open the Service folder inside the History folder. The folder lists the saved detection files and subfolders.
5. Select everything inside the Service folder by pressing Ctrl+A on your keyboard. All files and folders should be highlighted.
6. Right-click the selected items and choose Delete. In Windows 11 this is the trash can icon at the top of the menu. If a warning says you need permission from the system, confirm that you want to proceed. If Windows says a file is in use, click Skip and carry on, then see the troubleshooting section below.

That’s it for Phase 2. The saved detection files are deleted, apart from any that Windows refused to remove. Go straight to Phase 3 to turn protection back on.

Phase 3Turn Tamper Protection Back On

1. Go back to the Windows Security app by searching for it in your Start menu.
2. Click Virus & threat protection, then click Manage settings.
3. Find Tamper Protection and click the switch to turn it back On. Approve the User Account Control prompt if it appears.

4. Close the Windows Security window and restart your🔄 computer to finish the process. After the restart, open Windows Security again if you want to confirm the switch still shows On.

You should now have Tamper Protection back on and your history logs cleared. Your PC is fully protected again, and you can reconnect to any network you avoided during the process.

Alternative Method: Clearing Protection History via PowerShell

PowerShell is a text-based tool that lets you run commands instead of clicking through File Explorer. It needs administrator rights, and Tamper Protection still has to be off first, so complete the first phase before you start here. This route skips the hidden folders, which saves time if you do this often. The same warning about weakened protection applies until you finish.

1. Click the Start button, type PowerShell, right-click Windows PowerShell in the search🔍 results, and choose Run as administrator.

2. Click Yes on the prompt asking for permission to make changes to your computer. A PowerShell window opens. If the title bar does not say Administrator, close it and repeat the first step.
3. Type or copy and paste the command shown below into the PowerShell window, then press Enter:

   💻Code

   Copy

   Remove-Item -Path "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\*" -Recurse -Force

4. Wait for the command to finish. If it runs without an error message, close the PowerShell window. A red error message usually means PowerShell is not running as administrator or Tamper Protection is still on.
5. Turn Tamper Protection back on in your Windows Security settings, following the steps in the phase on turning it back on above.

That’s it for the PowerShell method. The command has cleared the log files, and Tamper Protection is back on once you finish the last step.

Expert Tips for Managing Stubborn Windows Security Logs

If the logs refuse to delete or keep coming back, the cause is usually an out-of-date system or a background service holding the files open. Updating Windows and restarting the computer fixes most of these cases.

First, make sure your operating system is fully updated. Microsoft regularly releases patches that fix bugs in Windows Security and its logging services. Open Settings, go to Windows Update, and click Check for updates. If a bug is making old scan results repeat on your screen, an update often resolves it. Restart afterward if Windows asks you to.

Second, if you get permission errors while deleting files inside the Service folder, try restarting in Safe Mode. Safe Mode loads Windows with only the minimum drivers and services, which stops background programs from locking your security log files. To get there on Windows 11, open Settings › System › Recovery, click Restart now next to Advanced startup, then choose Troubleshoot › Advanced options › Startup Settings › Restart and press 4.

Once you are in Safe Mode, clear the history folder, restart your computer normally, and turn Tamper Protection back on. Check that the switch still shows On before you finish. If the files still will not delete, the built-in Protection history page and Event Viewer, described earlier, remain available.

Summary

Clearing Windows Security protection history logs manually is a reliable way to remove old threat alerts that Windows will not delete on its own. Turn off Tamper Protection, open the hidden system folders, delete the log files, and then turn Tamper Protection back on. That last step matters most, because it leaves your PC fully protected again.