Hello, I have checked the Event Viewer Windows logs Application Security System Applications and Services Microsoft > Windows > Windows Defender > Operational I checked also EndpointProtection.log in C:\Windows\CCM\Logs & also C:\ProgramData\Microsoft\Windows Defender\Support\MPLog-202302xx.log I could not find what I need. I need to see what was scanned by Windows Defender between 02:00 am and 02:30 am this morning: files, paths, processes, etc... Thanks, Dom

Hello Thank you for your question and reaching out. I can understand you are having query\issues related to Defender. Please note that associated event IDs are : Windows Defender scan has started. (Event ID 1000) Windows Defender scan has finished. (Event ID 1001) Windows Defender signature version has been updated. (2000) Also please check this path : C:\Windows\Microsoft Antimalware\Support and C:\ProgramData\Microsoft\Windows Defender\Offline Scanner --If the reply is helpful, please Upvote and Accept as answer--

Windows defender logs

Duchemin, Dominique 2,006

Hello,

I have checked the Event Viewer

Windows logs
Application
Security
System
Applications and Services
Microsoft > Windows > Windows Defender > Operational I checked also EndpointProtection.log in C:\Windows\CCM\Logs & also C:\ProgramData\Microsoft\Windows Defender\Support\MPLog-202302xx.log I could not find what I need. I need to see what was scanned by Windows Defender between 02:00 am and 02:30 am this morning: files, paths, processes, etc...

Thanks,

Dom

Olivia Brown 5 Reputation points

2023-06-20T18:08:04.9766667+00:00
Hello Dom,

To view the details of what was scanned by Windows Defender between 02:00 am and 02:30 am this morning, you can try the following steps:

Open Event Viewer: Press the Windows key + R, type "eventvwr.msc," and hit Enter.

In Event Viewer, expand the "Windows Logs" folder on the left-hand side.

Click on "Microsoft-Windows-Windows Defender/Operational" to view the Windows Defender operational logs.

In the middle pane, you should see a list of events. Look for events with the source "Windows Defender" and event ID "1001" or "1006." These events provide information about the scans performed by Windows Defender.

Double-click on an event to view its details. You can check the "General" and "Details" tabs for information about the scanned files, paths, processes, and other relevant details.

Note: The Windows Defender operational logs might not provide a detailed list of every file or path that was scanned during a specific time period. However, it should give you a general overview of the scans performed by Windows Defender.

If you still cannot find the specific information you need, it's possible that the level of detail you're looking for is not captured in the standard Windows Defender logs. In that case, you may need to enable more detailed logging or consider using a specialized third-party security tool for comprehensive scanning and logging capabilities.

I hope this helps! Let me know if you have any further questions.
Duchemin, Dominique 2,006 Reputation points

2023-06-20T21:07:56.46+00:00

Hello

I opened this link "Microsoft-Windows-Windows Defender/Operational" but I could not find any event 1001 or 1006 ...

Also no detail about what has been scanned...

I will check more machines to see if I could find at least the events 1001 or 1006.

Thanks,

Dom

2 answers

Limitless Technology 43,941 Reputation points

2023-02-24T12:09:32.8233333+00:00

Hello

Thank you for your question and reaching out. I can understand you are having query\issues related to Defender.

Please note that associated event IDs are :

Windows Defender scan has started. (Event ID 1000)

Windows Defender scan has finished. (Event ID 1001)

Windows Defender signature version has been updated. (2000)

Also please check this path : C:\Windows\Microsoft Antimalware\Support and C:\ProgramData\Microsoft\Windows Defender\Offline Scanner

--If the reply is helpful, please Upvote and Accept as answer--
Please sign in to rate this answer.
Duchemin, Dominique 2,006 Reputation points

2023-02-24T15:50:16.7733333+00:00

Hello,

"Also please check this path : C:\Windows\Microsoft Antimalware\Support and C:\ProgramData\Microsoft\Windows Defender\Offline Scanner"

These folders do not exist:

2023-02-24_7-47-13 VIPMEDOLTPDB01.pdf

2023-02-24_7-49-17 VIPMEDOLTPDB01.pdf

Any other locations?

Thanks,

Dom
Sign in to comment
Limitless Technology 43,941 Reputation points

2023-02-24T12:17:57.7366667+00:00

Double post
Please sign in to rate this answer.

0 comments No comments
Sign in to comment