How to Restore Files Removed by Windows Defender in Windows 11

Windows Defender, officially known as Microsoft Defender Antivirus, does an excellent job of protecting your PC from malware and suspicious files. However, sometimes it can be a little overprotective. You might find that a trusted file — perhaps a custom script, mod, or installer — has suddenly vanished after a security scan.

When this happens, Defender usually quarantines the file instead of deleting it outright. That means you can often restore it safely if you’re certain it’s not harmful. In this guide, we’ll walk you through how to recover files that Windows Defender has removed or quarantined in Windows 11.

What You’ll Need

Before you begin, make sure you have administrator access on your PC. You’ll also need to confirm that the file you’re restoring is safe and not infected. Never restore a file unless you’re absolutely sure it’s from a trusted source.

Tip: If you downloaded the file from the web, try scanning it on another device or using Microsoft’s online Safety Scanner tool before restoring it to ensure it’s not actually dangerous.

Step 1: Open Windows Security

Windows Defender’s quarantine and protection history are located in the Windows Security app.

1. Press Windows + I to open Settings.
2. Navigate to Privacy & security → Windows Security.
3. Click Open Windows Security.

This will open the main dashboard where you can view Defender’s protection features and recent security actions.

Step 2: Go to Virus & Threat Protection

From the Windows Security dashboard:

1. Click Virus & threat protection on the left-hand panel.
2. Under Current threats, click Protection history.

This section lists all recent actions taken by Windows Defender, including blocked items, quarantined files, and cleaned threats.

Step 3: Locate the Quarantined File

The Protection history page displays a chronological list of Defender’s actions. Each entry includes the file name, date, and the type of action performed.

1. Look for items labeled Quarantined or Blocked.
2. Click the arrow next to an item to expand it and view more details, including the file’s original path.
3. Verify that the file in question is indeed something you trust and recognize.

If you’re not sure, right-click the item and select View details to get more information about why Defender flagged it.

Step 4: Restore the File

Once you’ve confirmed that the file is safe, you can restore it directly from Windows Security.

1. In the expanded details view of the quarantined item, click Actions.
2. Choose Allow on device or Restore.
3. Windows will restore the file to its original location.

After restoring, the file should reappear in the same folder it was originally located in. If you don’t see it immediately, refresh the folder or restart your computer.

Step 5: Exclude the File or Folder from Future Scans (Optional)

If Windows Defender keeps removing the same file every time it scans your PC, you can add an exclusion to prevent that from happening again.

1. In the Windows Security app, go to Virus & threat protection settings → Manage settings.
2. Scroll down and click Add or remove exclusions.
3. Select Add an exclusion, then choose File or Folder.
4. Browse to the file or folder you want to exclude and confirm.

Defender will skip that file or folder in future scans. Only do this for files you’re certain are safe — excluding unknown or suspicious items can expose your system to risks.

Step 6: Check the Quarantine Folder Manually (If Needed)

If the file doesn’t appear in Protection History or the restore option isn’t available, you can check Defender’s quarantine folder manually.

1. Open File Explorer.
2. Navigate to the following path: C:\ProgramData\Microsoft\Windows Defender\Quarantine
3. By default, this folder is hidden. If you don’t see it, enable hidden items in File Explorer by clicking View → Show → Hidden items.

The quarantined files here are encrypted and renamed for safety, so you can’t simply copy them back. However, confirming their presence can help you know whether Defender quarantined or deleted them entirely.

Step 7: Restore Files Using PowerShell (Advanced)

If the graphical interface doesn’t show the file, you can use PowerShell to view and restore quarantined items.

1. Open PowerShell (Admin) by pressing Windows + X and selecting Windows Terminal (Admin).
2. Run this command to list all quarantined items: Get-MpThreatDetection
3. To restore a specific quarantined file, run: Restore-MpThreat -Name "<ThreatName>" Replace <ThreatName> with the exact name shown in the results from the previous command.

This command tells Defender to restore the selected quarantined file back to its original location.

Step 8: Use File History or Backup (If Defender Permanently Removed It)

If the file doesn’t exist in quarantine, Windows Defender might have deleted it completely. In that case, your best option is to restore it from a backup.

1. Open Settings → System → Storage → Advanced storage settings → Backup options.
2. If you have File History or OneDrive Backup enabled, browse to the file’s original folder.
3. Use the Restore previous versions option from the folder’s context menu if available.

If no backup is available, try checking your cloud storage or any external drives you’ve used recently.

Wrapping Up

Windows Defender can sometimes be overly cautious, removing files that you know are safe. Fortunately, most of the time those files are simply quarantined, not deleted. By checking the Protection history in Windows Security or using PowerShell, you can restore quarantined files in just a few clicks.

Just remember to verify the safety of every file before restoring it — antivirus tools flag files for a reason. Once you’ve confirmed it’s a false alarm, restoring and excluding it ensures your system remains both secure and functional.

And if you’ve ever wondered how cautious Defender can be, consider it your overprotective friend — sometimes annoying, but almost always looking out for you.