Restore quarantined files in Microsoft Defender Antivirus - Microsoft Defender for Endpoint (2024)

FAQs

Restore quarantined files in Microsoft Defender Antivirus - Microsoft Defender for Endpoint? ›

On your Windows device, open Windows Security. Select Virus & threat protection and then, under Current threats, select Protection history. If you have a list of items, you can filter on Quarantined Items. Select an item you want to keep, and choose an action, such as Restore.

Files that were quarantined by Microsoft Defender Antivirus or your security team are saved in a compliant way according to your sample submission configurations. Your security team can download the files directly from the file's detail page via the "Download file" button. This feature is turned 'On' by default.

To open the Microsoft Defender portal, go to https://security.microsoft.com. To go directly to the Quarantine page, use https://security.microsoft.com/quarantine.

On your Windows device, open Windows Security. Select Virus & threat protection and then, under Current threats, select Protection history. If you have a list of items, you can filter on Quarantined Items. Select an item you want to keep, and choose an action, such as Restore.

Quarantined files are not automatically deleted. When F-Secure app quarantines a file, it means that it has identified the file as a potential threat and has isolated it from the rest of your system. This prevents the file from causing any damage to your computer or network.

"Win" logo key + "Q" to open the search box and type "Security", right-click "Windows Security" at the top of the result list > "App settings" > ”Reset“.

In Exchange Online Protection (EOP) and Microsoft Defender for Office 365, quarantine policies allow admins to define the user experience for quarantined messages: What users are allowed to do to their own quarantined messages (messages where they're a recipient) based on why the message was quarantined.

What does it mean to quarantine a file? ›

Files tagged for quarantine are encrypted and moved to a protected folder, preventing further execution and potential harm to the user's system. Each product has a Quarantine Manager where users can permanently delete or restore files from quarantine.

When an email is flagged as potentially harmful or spam, it may be sent to quarantine to protect users. The quarantined email is placed in a secure environment where you can view its content without risk.

Quarantine summary messages

You can choose to send a quarantine summary message to each protected mailbox. The message contains a table containing quarantined messages since the last summary message was sent. You can schedule when quarantine summary messages are sent.

Removing quarantined items

In most cases, Windows Defender will quarantine only harmful files. Quarantined files no longer pose a threat to your computer, and you can safely remove them: Check the box next to each item you want to remove. Click Remove.

Remove deletes the file from your PC. Quarantine moves the file to a safe location and blocks it so it can't run.

Uninstalling Bitdefender won't restore the quarantined items back to their original location. They remain isolated unless you choose to manually restore them.

Should I remove, quarantine, or allow a threat? This depends on how much you know about the file that has been detected. Remove deletes the file from your PC. Quarantine moves the file to a safe location and blocks it so it can't run.

Items placed in quarantine cannot damage your system, but you can delete an infected item or a potentially unwanted program if you want to completely eliminate it.

Anti-virus software often resorts to using a quarantine when it is unable to clean an infected file. Once the virus or file has been quarantined, it cannot interact with the system. It is advisable to delete suspected quarantined files as soon as possible.