The Windows Defender quarantine location on disk is:
C:\ProgramData\Microsoft\Windows Defender\Quarantine
ProgramData is a hidden folder, so you will not see it in File Explorer until you enable hidden items — and even then, the Quarantine folder is access-controlled and will usually refuse to open, including for an administrator.
That is working as intended. Read the next section before trying to force your way in, because the files in there are not useful to you in the state they are stored in.
Why You Cannot Just Copy Files Out of It
Quarantine is not a recycle bin. When Defender quarantines a detection it moves the file into this protected store and keeps it in an altered, non-executable form, along with metadata about the detection. The point is that the file cannot run, cannot be opened by another program, and cannot be picked up accidentally by something else on the system.
Two consequences follow:
- Copying files out of the folder does not give you your file back. What you would get is not the original.
- Taking ownership of the folder to browse it is a bad idea. You are weakening the protection around known-malicious content to no benefit, since the supported restore paths below produce the actual file.
Use Windows Security or MpCmdRun.exe. Both write the original file back properly.
Before You Restore: This Is a Security Decision
Restoring re-enables a file that your scanner identified as a threat. Sometimes that is correct — false positives are real and common for developer tools, game mods, and self-written scripts. Sometimes it is how an infection gets a second chance.
Verify before you restore, not after:
- Do you know exactly where the file came from? An official vendor download is a different proposition from a file that appeared in your Downloads folder.
- Check the detection name in Protection history. A generic heuristic name such as one containing
WacatacorSabsikis more often a false positive than a specific named family, though neither is a guarantee. - Get a second opinion. Upload the original installer — not the quarantined copy — to VirusTotal. If 1 or 2 engines of 70 flag it, a false positive is plausible. If 30 do, it is not.
- Compare the hash against the one the vendor publishes, if they publish one.
Never restore an attachment you did not expect, cracked software, keygens, or anything you cannot account for. If you cannot explain why the file is on your machine, leave it where it is.
Restore Using Windows Security
The route most people should use:
- Open Windows Security (search for it from Start).
- Select Virus & threat protection.
- Under Current threats, select Protection history.
- Select Filters and choose Quarantined items.
- Select the item you want to inspect. The detection name, path, and date are shown here.
- Choose Actions, then Restore.
If the item is not listed, it was either removed rather than quarantined, or already purged by policy.
Restore Using MpCmdRun.exe
Use this when the interface will not cooperate, when you need to script it, or when you want the exact list of what is held.
MpCmdRun.exe must be run from an elevated Command Prompt, and its folder is not on your PATH. Microsoft documents two locations:
C:\Program Files\Windows Defender
C:\ProgramData\Microsoft\Windows Defender\Platform\<antimalware platform version>
The newest copy is the one under Platform\<version> when it exists, so prefer that:
cd "C:\ProgramData\Microsoft\Windows Defender\Platform"
dir
cd <the highest version number listed>
List what is quarantined:
MpCmdRun.exe -Restore -ListAll
The documented -Restore options are:
| Option | What it does |
|---|---|
-ListAll | Lists all quarantined items |
-Name <name> [-All] | Restores the most recently quarantined item for that threat name. With -All, restores every item under that threat name |
-FilePath <QuarantinedFilePath> | Restores an item by the file path of the quarantined item |
-Path <path> | Restores to the path you specify. Without it, the item goes back to its original location and leaves quarantine; with it, the item is written to your path and stays in quarantine |
-Output <filename> | Writes all quarantined item names to a file, UTF-8 encoded |
One detail causes most of the confusion here: -Name takes a threat name, not a file name. Take the value from the -ListAll output rather than typing the name of your file.
MpCmdRun.exe -Restore -Name "Trojan:Win32/Wacatac.B!ml"
To pull a copy out for analysis while leaving the original safely quarantined, combine -FilePath with -Path — that restores to your chosen folder without releasing the item from quarantine:
MpCmdRun.exe -Restore -FilePath "<path from -ListAll>" -Path "C:\Analysis"
If Windows reports that MpCmdRun is not recognised, you are not in one of the two folders above — that is the documented cause.
How Long Items Are Kept
There is no single number worth quoting. Retention is governed by the Configure removal of items from Quarantine folder policy (registry value PurgeItemsAfterDelay under HKLM\Software\Policies\Microsoft\Windows Defender\Quarantine). Microsoft's description of that setting states that when it is disabled or not configured, items are kept in the quarantine folder indefinitely and are not automatically removed.
On a managed work device, your IT team may well have configured a purge. Treat quarantine as temporary storage either way and restore what you need promptly.
Preventing a Re-Quarantine
If the detection still matches, the next scan quarantines the file again. Add an exclusion only after you have satisfied yourself it is a false positive:
- Windows Security → Virus & threat protection
- Under Virus & threat protection settings, select Manage settings
- Scroll to Exclusions → Add or remove exclusions
- + Add an exclusion → File, then select the restored file
Exclude the specific file, not its parent folder. A folder exclusion creates a blind spot that anything later written there inherits — and Downloads or Temp exclusions are a genuinely dangerous habit.
Better still, report the false positive to Microsoft through the Microsoft Security Intelligence submission site. A corrected signature fixes it for everyone and removes the need for a permanent exclusion.
Microsoft 365 Quarantine Is a Different System
People searching for "Microsoft quarantine" often want email, not files, and the two are unrelated. Microsoft Defender for Office 365 quarantines messages in the cloud; nothing there ever appears in Windows Security on your PC, and nothing quarantined by Defender Antivirus appears in the portal.
For quarantined email, go to the Microsoft Defender portal at security.microsoft.com/quarantine, or navigate to Email & collaboration → Review → Quarantine → the Email tab. Select a message to see its details, then act on it.
What you are allowed to do depends on the quarantine policy attached to the reason it was quarantined:
- Release delivers the message to your mailbox. Note that releasing re-delivers the message, so it appears in Outlook with the re-delivery time as its timestamp; the original send date is preserved in the headers.
- Request release asks an admin to approve it. A policy allows one or the other, never both for the same message.
- A greyed-out Release button is expected behaviour, not a fault. By default, messages quarantined as high confidence phishing, as malware, or by a mail flow rule are available to admins only and are not visible to users at all.
Messages are permanently deleted after the date in the Expires column, and expired messages are unrecoverable.
One safety note specific to email: if a message was held because it contains an encrypted attachment, you are prompted for the attachment password on release. Enter only the password the sender used for that file — never your account password or any other credential — and only when you expected the message and can vouch for the sender.