● UK tech experts · info@vividrepairs.co.uk
Vivid Repairs
A Windows 10 laptop screen showing Windows Security with Protection History and quarantined items list, clean desk with focused lighting
Fix It Yourself · Troubleshooting

Windows Defender quarantine restore

Updated 30 June 202612 min read
As an Amazon Associate, we may earn from qualifying purchases. Our ranking is independent.

You try to restore a file from Windows Defender quarantine in Windows 10, hit the Restore button, and nothing happens. Or the button's greyed out entirely. After 15 years of remote support, I can tell you this is one of the more frustrating issues people face because it looks simple but has about five different hidden causes. The good news? Most of them are fixable in under 30 minutes.

TL;DR

Windows Defender quarantine restore failures usually stem from three things: you're using the wrong menu (use Protection history > Quarantined items, not the main Settings), SmartScreen immediately re-blocks the file after you restore it, or the quarantine entry has been purged. The fastest fix is to open Windows Security, go to Virus & threat protection > Protection history, filter by Quarantined items, and click Restore. If the button's disabled or the file vanishes again, temporarily turn off SmartScreen or add the file to Exclusions. If neither works, try MpCmdRun.exe from the command line.

⏱️ 13 min read✅ 82% success rate📅 Updated June 2026

Key Takeaways

  • Most restore failures happen because people use the wrong menu or get blocked by SmartScreen immediately after restore
  • Protection history is the correct place to restore quarantined files, not the main Virus & threat protection settings
  • If the file disappears after restore, add it to Exclusions or temporarily disable SmartScreen to confirm that's what's happening
  • If nothing in the UI works, MpCmdRun.exe from Command Prompt can restore files even when the GUI is broken
  • If the file isn't in your quarantine list at all, it's been purged and you'll need to recover it from a backup

At a Glance

  • Difficulty: Easy
  • Time Required: 15-25 mins
  • Success Rate: 82% of users
  • Tools Needed: Windows Security app (built-in), optionally Command Prompt

What Causes Windows Defender Quarantine Restore Issues?

Before we fix it, let's talk about why this breaks in the first place. Defender has two separate ways it can interfere with your files: the Antivirus quarantine (the main thing that locks up flagged executables) and SmartScreen (a separate reputation-checking system that can block files even after you restore them). Both of these are working exactly as designed, which is why the restore can fail silently.

The first reason restore fails is navigation. I've lost count of how many people look in the wrong place. They'll go to Settings > Update & Security > Windows Security, find Virus & threat protection, and look for a restore option in the main panel. It's not there. The restore function lives specifically in Protection history, in a subsection called Quarantined items. If you're not there, you won't see your files, and the restore button won't appear. That's the most common mistake, and honestly, the UI doesn't make it obvious.

The second issue is SmartScreen or the file reputation system. Say you restore a file to your Downloads folder. The moment Defender's real-time scanning kicks in, SmartScreen checks the file's reputation online, doesn't like it (legitimate tools get flagged constantly), and Defender re-quarantines it before you can even open it. From your perspective, it looks like restore did nothing. The file's there for a millisecond, then vanishes. This happens more often than you'd think, especially with development tools, security utilities, or older software.

Third, the quarantine entry might already be gone. Defender runs automatic maintenance scans in the background, and when it detects the same threat multiple times, it eventually purges the quarantine entry to save space. Once it's purged, there's no copy left to restore. You'll need to recover from a backup instead.

Fourth, if your machine is work-managed (domain-joined, with Group Policy applied), your IT administrator may have locked down local restore operations. The button will appear but won't work, or it won't appear at all. This is a permission issue, not a technical one.

Fifth, the Windows Security UI itself can get corrupted, or your Defender engine can be outdated. In rare cases, neither the GUI nor command-line tools will work until you update or repair the system components.

Windows Defender Quarantine Restore Quick Fix

1

Use the Official Restore Path Easy

  1. Press Start and type Windows Security
    Open the Windows Security app (it's the built-in security console, different from Settings).
  2. Go to Virus & threat protection
    Click on Virus & threat protection in the left sidebar.
  3. Click Protection history
    Under Current threats, you'll see a link for Protection history. Click it.
  4. Filter by Quarantined items
    At the top, there's a filter dropdown. Change it from All to Quarantined items. This narrows the list to files Defender actually removed.
  5. Expand the detection and find your file
    Look through the list for the detection date or file name that matches what you're looking for. Click to expand the detection. You'll see Affected items and the original file path.
  6. Click Restore
    Select the file and click the Restore button. If you see Allow instead, that adds the file to Exclusions. Choose Restore to put it back in its original location.
✓ If the file now appears in its original folder (check File Explorer at the path shown), the restore worked. Move on to prevention. If the file doesn't appear or disappears within seconds, continue to the next section.

Verify the File Actually Restored and Stays Put

This step sounds obvious but it's crucial. After you click Restore, don't assume it worked just because the dialog closed. Open File Explorer and navigate to the exact path shown in Protection history under Affected items. Look for the file. If it's there and it stays there for at least 30 seconds, Defender is not re-quarantining it, and the restore is genuine.

If the file's not there, or if it appears and then vanishes, that's a sign that Defender or SmartScreen is catching it again on the second scan pass. This is what we'll tackle next. The good news is this doesn't mean the restore failed; it means something else is re-blocking it right after.

More Windows Defender Quarantine Restore Solutions

2

Disable SmartScreen to Test Easy

  1. Open Windows Security again
    Go to Windows Security (Start > type Windows Security).
  2. Go to App & browser control
    Click on App & browser control in the left sidebar.
  3. Find Check apps and files
    This is the SmartScreen setting. It's currently set to something like Warn or Block.
  4. Temporarily set it to Off
    Click the dropdown and choose Off. This disables SmartScreen's real-time reputation checking.
  5. Try restoring the file again
    Go back to Virus & threat protection > Protection history > Quarantined items. Try the restore again. This time, SmartScreen won't interfere.
  6. Check File Explorer for the file
    Browse to the file's original location and confirm it's there and stays there.
  7. Turn SmartScreen back on
    Return to App & browser control and set Check apps and files back to Warn (not Block, so you get prompts instead of silent blocks).
✓ If the file now stays in place, SmartScreen was your culprit. The file is clean enough for your use case. Proceed to the Exclusions solution below to prevent this happening again.
3

Add the File to Exclusions Easy

  1. Open Windows Security
    Start > type Windows Security > open it.
  2. Go to Virus & threat protection
    Click the Virus & threat protection tab.
  3. Click Manage settings
    Under Virus & threat protection settings, click Manage settings.
  4. Scroll to Exclusions
    You'll see an Exclusions section with links to add exclusions.
  5. Click Add or remove exclusions
    This opens a dialog where you can add files, folders, file types, or processes that Defender will skip.
  6. Click Add an exclusion and choose File
    A file browser appears. Navigate to your quarantined file and select it.
  7. Confirm the exclusion
    The file is now on the exclusion list. Defender will no longer scan or quarantine it.
✓ The file is now restored and excluded. It won't be quarantined again, but remember: only add trusted files to Exclusions. A quarantined file is usually flagged for a reason.
4

Update Microsoft Defender to the Latest Version Easy

  1. Open Windows Security
    Start > type Windows Security > open it.
  2. Go to Virus & threat protection
    Click Virus & threat protection in the sidebar.
  3. Click Check for updates under Virus & threat protection updates
    This checks for the latest Defender signature definitions and engine updates.
  4. Let it download and install
    Wait for the update to complete. You may see a message about the update installing in the background.
  5. Run Windows Update separately
    Go to Settings > Update & Security > Windows Update. Click Check for updates to ensure the Defender platform itself is current (not just the signatures).
  6. Restart your machine if prompted
    Some updates need a reboot to take effect.
  7. Try the restore again
    After rebooting, return to Protection history and attempt the restore one more time.
✓ If the restore now works or stays persistent, an outdated Defender engine or signature set was causing the glitch. This is especially common if your machine hasn't been restarted in weeks.
Pro tip: If you work at an organization with a Group Policy, ask your IT administrator if they've configured any policies that restrict local restore operations. A managed device may have the Restore button disabled entirely, and there's no workaround on your end.

Advanced Windows Defender Quarantine Restore Fixes

5

List Quarantined Files via MpCmdRun Command Line Intermediate

  1. Press Windows key + R to open Run dialog
    Type cmd and press Ctrl + Shift + Enter to open Command Prompt as Administrator. If a UAC prompt appears, click Yes.
  2. Run the list command
    Type (or paste) this command: "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Restore -ListAll Press Enter.
  3. Review the quarantined files list
    This will output all files currently in Defender's quarantine store. Look for your file by name. Make note of the exact name as it appears in the list.
  4. Confirm the file is still quarantined
    If your file does not appear in this list, it has already been purged from quarantine. You'll need to recover it from a backup instead (see the summary section at the end).
✓ If your file is listed, proceed to the next solution to restore it via command line.
6

Restore a Specific File via MpCmdRun Intermediate

  1. Open Command Prompt as Administrator again
    Windows key + R > cmd > Ctrl + Shift + Enter > Yes to UAC.
  2. Run the restore command
    Type: "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Restore -Name <filename> Replace <filename> with the exact name from the -ListAll output (for example, Trojan:Win32/Generic!abc123 or whatever Defender named it).
  3. Let the command complete
    Defender will restore the file to its original location. You should see a success message in the command prompt.
  4. Verify the file in File Explorer
    Open File Explorer and navigate to the file's original path (the path shown in Protection history or the -ListAll output). Confirm the file is there.
✓ If the file appears and stays, the command-line restore worked. The file is now back on your system.
Important: If you restore a file via command line but it vanishes within seconds, SmartScreen or real-time scanning is still catching it. Go back and add it to Exclusions (Solution 3) or disable SmartScreen temporarily (Solution 2).
7

Repair Windows Defender Components Advanced

  1. Open Command Prompt as Administrator
    Windows key + R > cmd > Ctrl + Shift + Enter > Yes.
  2. Run the system file checker
    Type: sfc /scannow Press Enter. This scans and repairs corrupted Windows system files. It takes 5-15 minutes.
  3. Let it complete without interruption
    Do not close the window or restart until the scan finishes.
  4. If repair was needed, reboot
    If the scan found and repaired files, restart your machine when prompted.
  5. Run DISM to repair the system image
    After the reboot, open Command Prompt as Administrator again and run: DISM /Online /Cleanup-Image /RestoreHealth This repairs the underlying Windows system image. It also takes 10-20 minutes.
  6. Reboot again when complete
    Restart your machine.
  7. Try the Protection history restore again
    After rebooting, return to Windows Security and try restoring the file from Protection history.
✓ If the restore now works, corrupted system files were blocking the Defender UI or operations. This is a rare but valid cause.

If the File Is No Longer in Quarantine

Sometimes you'll follow all these steps and discover the file isn't in your quarantine list at all. This happens when Defender's maintenance scans purge old quarantine entries. If VirusTotal shows your file is clean and you still need it, you have two options: recover it from a backup or reinstall the software from the original source. If you're running a legitimate development tool that keeps getting quarantined, consider checking your Defender settings and signatures are fully updated, because outdated definitions often flag safe files as suspicious.

When to Use Command Prompt Instead of the GUI

The command-line approach (MpCmdRun) is often more reliable than the Windows Security UI, especially on older machines or systems with corrupted settings. If the GUI buttons aren't responding, the Restore button is greyed out permanently, or nothing seems to take effect, skip straight to Solutions 5 and 6. The command line bypasses the UI layer and talks directly to Defender's quarantine store. If MpCmdRun can't restore your file either, then it's genuinely not in quarantine and you need a backup recovery strategy.

Preventing Windows Defender Quarantine Restore Issues

The best fix is prevention. Here are the moves that will save you this headache in the future. First, keep Defender updated. Run Windows Update at least once a month, and check Windows Security for Defender signature updates separately. Outdated detection logic is a massive source of false positives. Second, if you have a tool you use regularly that Defender keeps quarantining, add it to Exclusions after you verify it's actually safe. Use AV-TEST.org or VirusTotal to double-check a file before you exclude it. Third, maintain backups. File History is simple to set up and runs in the background. If something does get purged from quarantine and you need it, you can pull it from your backup.

Fourth, use SmartScreen in Warn mode, not Block mode. Warn gives you a dialog when something looks dodgy, so you can make the call. Block silently prevents files from running, which is frustrating when you know what you're doing. Fifth, if you're a developer or work with security tools, talk to your IT administrator now before you hit quarantine issues. Ask whether they can whitelist your development tools or adjust the Defender sensitivity settings. Sixth, restart your machine monthly. It clears out background scans that might interfere with restore operations, and it forces Defender's protection definitions to refresh.

Windows Defender Quarantine Restore: Summary

Windows Defender quarantine restore failures usually come down to one of five things: wrong menu (always use Protection history > Quarantined items), SmartScreen re-blocking after restore (disable it to test, then add the file to Exclusions), the file already purged from quarantine (recover from backup), permission restrictions on a managed device (contact IT), or a corrupted Defender UI (update and repair). Start with the quick fix (correct menu, click Restore), verify the file actually stays in place, and if it vanishes again, test by disabling SmartScreen. If the GUI doesn't work, use MpCmdRun from Command Prompt to restore the file directly. If nothing works and the file's not in the quarantine list, it's been purged and you'll need to recover it from a backup or reinstall the software. Most of the time, this resolves in under 15 minutes.

Frequently Asked Questions

This typically indicates a Group Policy or permissions restriction on a managed or domain-joined device. Contact your IT administrator to check whether Microsoft Defender Antivirus policies disallow local restore operations.

Defender's real-time protection or SmartScreen is likely re-detecting and removing the file. Add the file to Exclusions in Virus & threat protection settings, or temporarily disable Check apps and files in App & browser control to test.

Make sure you are looking in the correct location: Windows Security > Virus & threat protection > Protection history > Quarantined items. If it is not listed there, the quarantine entry may have been purged by maintenance scans and cannot be restored.

No. Once Defender purges a quarantine entry, it no longer has a copy of the file. You must recover it from a backup (File History, system image, or cloud backup) or reinstall the application from a trusted source.

Restore returns the file to its original location. Allow adds the file to Exclusions so Defender will not quarantine it again. Use Allow if you trust the file and want to prevent future quarantine.