Share via

Cannot restore quarantined files from a network share.

Anonymous
2020-02-11T18:27:54+00:00

Hi all,

Question

I'm using Windows 10 Pro 1909

I have some quarantined files that Windows defender removed from my NAS share, when I was moving folders. (Collection fun/joke files, so not real virus and some old keygens from software that I really own. I see you thinking :)

I see the restore option in Windows Defender, but it does not work. Is it because they are files from a network drive?

I did make the folder structure the same on the NAS and I disabled Defender real time scan, but no luck.

Anyone an idea or solution? I see a lot of the same questions with Google Search, but I did not find a real solution so far.

Thanks,

Ronald

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous
2020-05-13T01:08:18+00:00

I had a very similar problem. In addition, I found the error 0x80508014 appearing in Windows' Event Viewer (see Review event logs and error codes to troubleshoot issues with Windows Defender Antivirus). Joanne's answer in the thread Where to restore quarantined items in Windows 10 creator update? solved the problem for me:

  • Open an elevated command prompt (open start menu, type cmd, right click, choose "Run as administrator").
  • Navigate to C:\Program Files\Windows Defender ("cd C:\Program Files\Windows Defender" [Enter]).
  • Run "MpCmdRun.exe -?" to see a list of available commands.
  • Use MpCmdRun.exe to recover the quarantined files to a different location. I created an empty folder named "DefenderRecovery" in C:\ and then ran the command "MpCmdRun.exe -Restore -All -Path C:\DefenderRecovery".

Before the recovery, I also (temporarily) disabled Windows Defender's real-time monitoring.

Hope this helps.

Was this answer helpful?

60+ people found this answer helpful.
0 comments

4 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Reza-Ameri 45,816 Reputation points Volunteer Moderator
    2020-02-12T15:50:17+00:00

    Does they removed or are you seeing them in the NAS?

    Check Windows Defender History and see if they have been removed or quarantine?

    Was this answer helpful?

    3 people found this answer helpful.
    0 comments
  2. Reza-Ameri 45,816 Reputation points Volunteer Moderator
    2020-02-13T15:59:45+00:00

    Quarantine or Remove, won't place them in recycle bin.

    When they are removed, they are gone but when they are in Quarantine, you should be able to restore them. So when you click on Restore what happens? Is there any error message?

    If Restore won't work, try restart your PC and try again and if problem persist, report this issue through Feedback Hub app.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  3. Anonymous
    2020-02-12T16:23:09+00:00

    Does they removed or are you seeing them in the NAS?

    Check Windows Defender History and see if they have been removed or quarantine?

    they removed

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  4. Anonymous
    2020-02-12T18:10:55+00:00

    Does they removed or are you seeing them in the NAS?

    Check Windows Defender History and see if they have been removed or quarantine?

    Yes they are removed from the NAS and visible in the history with the option to delete or restore, but this restore doesn't work

    and the Windows Defender removed the files also from the NAS recycle bin.

    I turned of the realtime scanner, but Windows Defender automatically put the realtime scanner back on and in meantime when I try to recover the files from the recycle bin, this files were deleted also. I have installed another antivirus and disabled the realtime, so Defender stays off.

    But with another antivirus installed I don't have access to the history/quarantined files anymore, options are gone.

    Also when I disable Windows Defender with GPO/registry, the Windows Defender quarantaine/history options are gone.

    I don't want to use Windows Defender with this behaviour in future, so I need an 3rd party antivirus where I can set better action on detection options.

    Maybe some Powershell or Dos command's that I can use for restore?

    Was this answer helpful?

    0 comments