Event log "Windows Defender/Operational" moved from under Applications and Services Logs/Microsoft/Windows to directly under Applications and Services Logs

Question

Been doing some work collecting Event logs for Defender and noticed that the Windows Defender event log that normally sits under Applications and Services Logs/Microsoft/Windows has moved to sit directly under Applications and Services Logs

Windows Defender no longer exists under the Microsoft/Windows folder structure it maps to on all other systems.
In reading, the common theme is 'you can't move this folder' so kind of a surprise to find it sitting here.

Anyone know how to correct this?

Answer 1

So appears to be some registry moves. How or why this happened I can't speak to but looks like some keys were removed/moved Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC and Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational