Can’t Restore Quarantined Files in Windows Defender? Here’s What to Do

What Windows Defender Quarantine Is and How It Works?

Windows Defender quarantine is a security feature that automatically isolates suspicious files to prevent them from harming your system. When a file is detected as potentially dangerous, Defender moves it into quarantine instead of immediately deleting it. This gives you a chance to review the file before taking further action.

Unlike deleting a file, which permanently removes it from your system, or ignoring a threat, which leaves it active, quarantining keeps the file in a safe, isolated state. This way, malicious files can’t execute, but you still have control over what happens next. Common quarantined files include:

• Downloaded software from unverified sources
• Executable files (.exe) flagged as malware
• Scripts or macros from email attachments
• Potentially unwanted programs (PUPs)that may install adware or tracking software

Can’t Restore Quarantined Files in Windows Defender

Many users report that Windows Defender keeps quarantining my files, but I can't restore them. Don’t worry if you have the same question; it’s usually for one of these reasons:

• File Removed or Corrupted by Windows Defender: Sometimes, Windows Defender determines that a file is too risky and automatically deletes or quarantines it in a way that prevents restoration.
• File Still Flagged as a Threat: Even if you believe a file is safe, Windows Defender may continue to detect suspicious behavior and block restoration.
• Permission or System Restrictions: Windows permissions or system policies may prevent you from restoring certain files, especially if you’re not using an administrator account.

How to Restore Quarantined Files in Windows Defender Safely

Before attempting to restore a quarantined file, it’s important to confirm whether it’s actually safe. Look out for signs that a file is truly unsafe:

• Windows Defender alerts describing the threat type
• File origin from unknown or untrusted sources
• Behavior potentially compromising system security, such as executable files containing unintended scripts

Way 1: Check the Protection History

If you’re confident that a quarantined file is safe, you can attempt to restore it directly through Windows Security. Be sureto follow the correct steps and proceed with caution.

Step 1. Open Windows Security from the Start menu. Navigate to Virus & threat protection and click on Protection history to view recent security actions.

Step 2. Find the quarantined file in the list. To narrow its scope, click Filters and select Quarantined items.

Step 3. Click on the file to expand details and select Actions > Restore.

During the process, Windows Defender may display a warning if the file is still considered risky. In some cases, the Restore option may be unavailable or fail due to ongoing threat detection. Running the process as an administrator can sometimes help resolve permission issues.

Way 2: Restore Quarantined Files using MpCmdRun.exe

Sometimes, Windows Defender won’t restore the files as they are dangerous, and they might not even appear in history. In this case, try MpCmdRun.exeto restore quarantined files, which is part of Windows Defender, is especially useful when the Windows Security interface doesn’t allow restoration.

Step 1. Type cmd in the Start menu, right-click it, and select Run as administrator.

Step 2. In the Command Prompt window, type the following commands to find quarantined files that won’t appear and restore them.

• cd "%ProgramFiles%\Windows Defender"
• MpCmdRun.exe -restore -listall
• MpCmdRun.exe -restore -name “Filename”

If you still can’t restore quarantine files in Windows Defender, try disabling file checking temporarily. Go to Windows Security > App & browser control > Check apps and files and set it to Off.

Best Practices for Handling Trusted Files

If you frequently encounter files being flagged incorrectly, adding them as exclusions in Windows Defender can help prevent repeated quarantining. However, this should be done carefully to avoid weakening your system’s security.

📌 To add exclusions safely:

• Only exclude files or folders from trusted and verified sources
• Avoid excluding entire directories unless absolutely necessary
• Regularly review your exclusion list and remove anything outdated

Properly managing exclusions ensures that legitimate files can run smoothly without being repeatedly flagged, minimizes the risk of allowing real threats through, while reducing interruptions caused by false positives. In addition, to reduce the chances of false positives, it’s essential to update Windows Defender regularly.

Safer Way to Protect Files without Any Interruption

Windows Defender keeps quarantining my files, making users frustrated, especially when files do not show up in history. Is there a safe way to protect my files without interruption? Yes, try proactive data protection software - AOMEI Backupper Professional.

It integrates complete backup solutions and features a Ransomware Protection tool that continuously monitors disk I/O activities, thereby protecting backups and critical data from deletion, encryption, or tampering.

Step 1. Open AOMEI Backupper Professional after installing. Under the Tools tab, click Ransomware Protection.

Step 2. Toggle the Enable Ransomware Protection tab. The option to protect backup image created by AOMEI Backupper is automatically checked. To enhance data security, specify file type, files, or folders

• Protect Specific File Types: Enter the extensions you frequently use to protect them.
• Protect Specific Files and Folders: Enter specific folder paths, such as C:\Program Files (x86), C:\ProgramData, etc.

Once enabled, you’ll be asked to add apps to trust or block list. Check the specific app and click Add to Trust List or Add to Block List. Or click Ignore.

Step 3. Switch to the Trust List, Block List, Block History, and manually configure them. In the Block History window, you can choose to clear block history, add to trust list, or add to block list.

Conclusion

Can’t restore quarantined files in Windows Defender can be frustrating, especially when you’re sure the file is safe. In most cases, the issue comes down to security restrictions, ongoing threat detection, or system permissions designed to protect your device. Try Windows Security or MpCmdRun.exe to resolve the issue.

In addition, you can directly protect backup images or individual files, which are often targeted by attackers. You need a proactive ransomware protection software - AOMEI Backupper Professional, with complete backup solutions and a Ransomware Protection tool.