Microsoft Defender restore quarantined file or app

If Microsoft Defender quarantined a file, app, or action you trust, restore it from Protection history. That puts the quarantined item back on the device only if Defender still has a recoverable copy. Check what was detected first, because restoring the wrong item can bring back something harmful.

What you’ll see

You usually notice this when a file won’t open, an installer disappears, or Windows Security says Defender took action on something you were trying to use. The item may have been moved to quarantine, blocked, or removed from the location you expected.

If you only want the file back because it was blocked, don’t restore it until you’ve checked the detection details. If the file name, path, or threat name doesn’t match what you were working with, stop and verify it before you make any change.

Before you start

• Open Windows Security with an account that can view Protection history.
• Make sure you can identify the exact file, app, or action that was quarantined.
• If the item came from an untrusted source, was downloaded unexpectedly, or you can’t explain why Defender flagged it, do not restore it yet.
• If the item is part of work or school security policy, check with your IT admin before restoring or allowing it.

The exact labels in Windows Security can vary a little by Windows or Defender version, but the path is usually close to this:

Windows Security > Virus & threat protection > Protection history

How to find the quarantined item and restore it safely

1. Open Windows Security and go to Protection history.
2. Find the entry that matches the file, app, or blocked action you were trying to use.
3. Open the entry and read the details before you change anything. Check the detected name, the affected file path, and the action Defender took.
4. Restore the item only if the details match what you expected and you trust the source.
5. If Restore is available, select it.
6. Wait for Defender to finish the action, then try the file or app again.

If the item opens or runs normally after that, the restore worked. If the problem comes back right away, the item is still being treated as suspicious, or you may have restored the wrong detection.

Do not restore a file just to see what happens. If you are not sure what the item is, stop here and keep it quarantined until you can verify it.

If the restore button is missing, Defender may no longer have a quarantined copy to put back, or that entry may have been handled in a way that does not support direct restoration from Protection history. In that case, check whether a different detection entry matches the item you want.

What to do if the restore button is missing or the item keeps coming back

If Restore is missing, look for another entry in Protection history that matches the same file name, time, or threat description. A similar-looking entry is not always the same item, so compare the path and detection details before you try anything else.

If the item keeps getting quarantined after you restore it, pause before trying again. That usually means Defender still sees the file as suspicious, or the file is being recreated from another source. Recheck the file path, the source of the download, and whether you restored the right item.

Only after you are sure the file or app is legitimate should you consider allowing it or creating an exclusion for that exact file, folder, or app. Keep the exclusion as narrow as possible. Do not exclude a broad parent folder unless you trust everything inside it.

How to verify the restore worked

Open the file from its original location or launch the app you restored. It should stay available and should not be removed again immediately.

If Defender blocks it again right away, the restore did not solve the underlying issue. Go back to Protection history, confirm the detection details, and decide whether the item should stay quarantined.

Conclusion

If you’re unsure about the detection, leave it quarantined and get a second check before restoring it.

Frequently Asked Questions

Why is the Restore button missing in Protection history?

It usually means Defender no longer has a quarantined copy to put back, or the item was handled in a way that doesn’t support direct restoration from that entry. Check the detection details first, because a similar-looking entry may not be the one you need.

Should I add an exclusion after restoring a file?

Only if you’re sure the file or app is legitimate and you need Defender to stop blocking that exact item. Use the narrowest exclusion you can, and avoid broad folders unless you fully trust everything inside them.