Windows Defender Has Quarantined a File: What to Do
How to tell if it's a false positive, restore it safely, and stop it from happening again.
Windows Defender has moved a file to quarantine, considering it suspicious. First, some reassurance: quarantine isn't the same as deleting — the file is still there, isolated and disabled, giving you time to decide calmly what to do.
Is it a false positive or a real threat?
False positives are more common than they seem, especially with: programs downloaded outside official stores, game mods, lesser-known development tools, or files you've created or compiled yourself. If you recognise exactly where the file came from and trust the source, it's probably a false positive.
Warning: if you don't recognise the file, don't know where it came from, or it arrived as an email attachment or from an unreliable website, don't restore it. Quarantine is doing exactly its job in that case.
How to restore it (if you trust it)
- Windows Security → "Virus & threat protection" → "Protection history".
- Filter by "Quarantined items".
- Select the file → "Actions" → "Restore".
- Repeat the same path, but this time choose "Allow".
Step 4 is the one most people skip, and it's the most common reason the file goes back to quarantine shortly after restoring it: "Restore" only puts it back once, but "Allow" tells Defender not to flag it as a threat again in the future.
Warning: if the file you're about to restore is an
executable (.exe), create a system restore point first.
If it turns out it really was a threat, you'll be able to undo any
change it made, instead of losing that option.
If you need that type of file often
If you regularly work with the same type of tool and Defender flags it every time, instead of restoring it one by one each time, add a permanent exclusion: "Manage settings" → "Add or remove exclusions" → add the specific file, folder, or file type.
If Windows Defender won't let you restore it
Sometimes the graphical interface fails at the restore step. The alternative is doing it via commands from Command Prompt as administrator, which also shows you the exact error code if something fails:
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Restore -ListAll
This command lists quarantined files with their exact name, needed to restore a specific one via commands if the graphical interface doesn't respond.
Frequently asked questions
Is the quarantined file deleted?
No, quarantine is different from deletion: the file stays isolated and disabled in the system, unable to run or cause harm, but recoverable if you decide it was a false positive.
Why does the file go back to quarantine after restoring it?
Because the second step is missing: after 'Restore', you need to go back in and choose 'Allow' so Defender stops flagging it as a threat in the future. Restoring without allowing is only a temporary fix.
Is it safe to restore any quarantined file?
Not just any — only if you recognise its origin for certain and trust it. If you don't know where it came from or it arrived from an unreliable source, it's safer to leave it in quarantine or delete it directly.