How to Restore Quarantined Items From Windows Defender

Microsoft Defender, formerly known as Windows Defender, automatically scans your computer to protect it from malware, unwanted apps, and potential threats. When it detects something suspicious, it doesn’t always delete it right away. Instead, it moves the file into quarantine — a secure location where the file can’t harm your system.

This is a useful safety measure, but sometimes Defender mistakenly flags safe files as threats — especially scripts, mods, or certain third-party utilities. If you’re sure a quarantined file is safe, you can restore it easily.

In this guide, we’ll show you how to view and restore quarantined items from Microsoft Defender in Windows 11.

What You’ll Need

Before you begin, make sure you’re signed in as an administrator. You’ll also want to verify that the file you’re restoring is safe. Restoring an infected or compromised file can expose your system to security risks, so proceed only if you’re certain the file is legitimate.

Tip: If you downloaded the file online, scan it using Microsoft’s Safety Scanner or VirusTotal before restoring it.

Step 1: Open Windows Security

The quarantine feature is managed through the Windows Security app, which includes all Defender protection options.

1. Press Windows + I to open Settings.
2. Go to Privacy & security → Windows Security.
3. Click Open Windows Security.

This opens the main Microsoft Defender dashboard.

Step 2: Go to Virus & Threat Protection

From the Windows Security dashboard:

1. Click Virus & threat protection on the left pane.
2. Under Current threats, click Protection history.

This section records all recent Defender actions, including blocked, quarantined, or removed threats.

Step 3: View Quarantined Items

The Protection history page lists all the files and actions Defender has taken.

1. Look for entries labeled Quarantined or Blocked.
2. Click the arrow next to an entry to expand its details.
3. You’ll see information such as the file name, threat name, date, and original file location.

If the file listed is something you trust — for example, a setup file, custom macro, or a known utility — you can safely restore it.

Step 4: Restore the Quarantined File

Once you’ve identified the file, you can restore it directly from the Protection History page.

1. Click Actions under the quarantined item.
2. Choose Allow on device or Restore (depending on your Defender version).
3. Confirm when prompted.

Defender will immediately restore the file to its original location. If you’re unsure where that was, check the “File path” shown in the details before restoring.

Step 5: Exclude the File or Folder From Future Scans (Optional)

If Windows Defender keeps flagging the same file as a threat after you restore it, you can exclude it from future scans.

1. In the Windows Security app, click Virus & threat protection settings → Manage settings.
2. Scroll down and select Add or remove exclusions.
3. Click Add an exclusion and choose File or Folder.
4. Browse to the file or directory you want to exclude.

Once excluded, Defender will no longer quarantine or delete it during future scans. Only exclude items you’re completely sure are safe.

Step 6: Restore Quarantined Files Using PowerShell (Advanced)

If the Windows Security interface doesn’t show the file, or if you prefer a command-line method, you can restore quarantined files using PowerShell.

1. Press Windows + X and select Windows Terminal (Admin) or PowerShell (Admin).
2. Run the following command to list all quarantined items: Get-MpThreatDetection
3. Review the list and find the ThreatID or Name of the quarantined item you want to restore.
4. Then run: Restore-MpThreat -Name "<ThreatName>" Replace <ThreatName> with the exact name shown in the previous command.

This restores the quarantined file to its original folder.

Step 7: Manually Check the Quarantine Folder (Optional)

You can also view quarantined files manually, though they’re encrypted for safety.

1. Open File Explorer and navigate to: C:\ProgramData\Microsoft\Windows Defender\Quarantine
2. If you don’t see the folder, enable hidden items in File Explorer by selecting View → Show → Hidden items.

These files can’t be restored manually by copying them — they must be released through Windows Security or PowerShell. However, viewing this folder helps confirm that the file is still quarantined and not permanently deleted.

Step 8: Restore Files From Backup if Defender Permanently Deleted Them

If you can’t find the file in quarantine, Defender may have deleted it completely. In that case, your best option is to restore it from a backup.

1. Open Settings → System → Storage → Advanced storage settings → Backup options.
2. If you have File History or OneDrive Backup enabled, browse to the original folder.
3. Use Restore previous versions if available to recover the file.

If you use cloud backup or an external drive, check those locations as well.

Wrapping Up

Windows Defender’s quarantine feature helps protect your system by isolating suspicious files instead of deleting them outright. But it occasionally flags safe files incorrectly — and when that happens, you can easily restore them through the Windows Security interface or PowerShell.

Always double-check a file’s source and scan it before restoring to make sure it’s not truly malicious. Once you’ve verified that it’s safe, adding it to Defender’s exclusion list prevents future false positives.

With these steps, you’ll never lose an important file to an overzealous antivirus scan again — and you’ll keep full control over what stays and what goes on your system.