How to Clear Windows Defender Protection History in 4 Ways

Windows Defender, now called Microsoft Defender in Windows Security, keeps a Protection history log of threats it has detected or blocked. That history is useful for checking past detections, but it can also become cluttered with old entries you no longer need.

If Protection history is showing outdated items, is stuck, or you simply want to clear the log, there are a few different ways to do it. Some are built into Windows, while others use File Explorer or PowerShell for cases where the normal cleanup does not work.

What Protection History Does in Windows Security

Protection history records actions taken by Microsoft Defender, such as quarantined threats, blocked apps, and items you have allowed or removed. It is not the same as antivirus scanning itself; it is more like a history log of security events.

Method 1: Clear Protection History from Windows Security

In some cases, Windows Security will let you remove old threat records directly from the interface. This is the simplest option to try first.

1. Open Windows Security from the Start menu.
2. Select Virus & threat protection.
3. Under Current threats or Protection history, open the history list.
4. Look for an option such as Remove, Clear all recent items, or a trash/bin icon if it appears.
5. Follow the on-screen prompt to remove the entries.

Method 2: Delete the Protection History Files Manually

If the history keeps coming back or Windows Security will not clear it properly, you can remove the files that store the log. This often works when the interface does not.

1. Close Windows Security.
2. Open File Explorer.
3. Go to this folder: C:\ProgramData\Microsoft\Windows Defender\Scans\History
4. Open the Service folder inside History.
5. Delete the contents of that folder, or the folder itself if Windows allows it.
6. Restart Windows Security and check Protection history again.

If Windows says a file or folder is in use, Defender may still be running in the background. In that case, try again after closing security windows and waiting a moment, or use one of the other methods below.

Method 3: Clear the History by Using Event and Log Cleanup

Sometimes the visible Protection history is tied to Defender’s internal logging. Clearing old security event data can help remove stale entries when manual deletion is incomplete.

1. Press Windows + R, type eventvwr.msc, and press Enter.
2. In Event Viewer, expand Applications and Services Logs.
3. Look for Microsoft > Windows > Windows Defender or Microsoft Defender-related logs.
4. Review whether the security history entries are being preserved there as well.
5. If you are managing a work PC or using advanced policies, clear only logs you understand and have permission to change.

Method 4: Use PowerShell or an Elevated Command Prompt

If Defender history is stubborn, PowerShell can help you remove the stored history files more reliably. This is a better option for advanced users or when the normal methods fail.

1. Right-click the Start button and open Windows Terminal (Admin) or PowerShell (Admin).
2. Run a command to stop or manage Defender only if you understand the result and your system allows it.
3. Use PowerShell to delete the Protection history files from the Defender history folder.
4. Restart Windows Security and check whether the old entries are gone.

When Protection History Keeps Reappearing

If old entries return after you clear them, the cause is usually one of these:

• A scheduled scan or recent detection is recreating the log entry
• Defender cache files were not fully removed
• Windows Security is still reading the same stored history folder
• A third-party security tool or policy is restoring security records

In that situation, it helps to identify whether the entries are genuinely new detections or just old records being reloaded. If the same item keeps appearing after cleanup, there may be an active file, app, or policy causing the event again.

Which Method Should You Try First?

What to Do If You Only Want to Hide Old Entries

If your goal is just to keep the list tidy, you may not need to remove every Defender log file. In many cases, clearing the visible Protection history is enough for day-to-day use. Only use deeper cleanup methods if the list is stuck, cluttered, or causing confusion during troubleshooting.