Windows Defender Protection History Deletion Issue

Question

Dear Microsoft Support Team,

I hope this finds you well. I am writing to seek your assistance in resolving an issue I am facing related to Windows Defender Protection History. I wish to delete the history for security and privacy reasons; however, I am encountering a permission-related obstacle.

The problem arises when attempting to modify the permissions for Windows Defender Protection History. Upon trying to change the ownership of the files, I receive a notification indicating that I need to take permission from "SYSTEM." Additionally, I have noticed that the "Add" button, which allows the addition of any new owner to the permission list, is disabled, rendering me unable to make any edits or changes.

I have checked that i am the administrator in the settings, so please guide me through this

The pics are following so you can understand my question in a better way and can assit me too

When i click on SYSTEM then this appears after clicking on advanced

now on clicking change this happens nothing work snothing in my hands

You see i cant change i just can click on these that are trusted installers systems or administrators if i try to add after clciking on eidt in systems it will just say cant change on security level and then access denied

I have attempted various solutions, including running the Command Prompt with administrative privileges, but unfortunately, I have not been able to gain ownership or alter the permissions effectively.

I would greatly appreciate your guidance and support in resolving this matter. My intention is to securely delete the Windows Defender Protection History, and I am seeking your expertise to help me overcome the permissions issue.

If you could kindly provide step-by-step instructions or any necessary commands to take ownership and modify the permissions, it would be immensely helpful. I understand the sensitivity of these files and the potential risks involved, so I assure you that I will follow your instructions diligently.

Kindly tell me if this is related to any new updates in security of windows 11 or anything else

Thank you for your attention to this matter. I am looking forward to your prompt response and assistance.

Sincerely,

Asma-Muzzamil

Answer 1

Hello @Asma Muzzamil !

Welcome to Microsoft QnA!

If i understand correctly you cannot take ownership of these files , and it is expected

I can provide 2 links to try

1. https://www.makeuseof.com/windows-microsoft-defender-clear-history/

This is a recommendation from the user to to Clear the Microsoft Defender Protection History on Windows 10 & 11

  **2.If this does not work try stopping the service and re try manually ( Not recommended):**

You can follow the steps in the below article to turn on and off the defender in your environment.

Turn off Defender antivirus protection in Windows Security https://support.microsoft.com/en-us/windows/turn-off-defender-antivirus-protection-in-windows-security-99e6004f-c54c-8509-773c-a4d776b77960

Turn on Microsoft 365 Defender https://learn.microsoft.com/en-us/microsoft-365/security/defender/m365d-enable?view=o365-worldwide

If you are comfortable with Powershell then you can try out the below article for some insights. Use PowerShell cmdlets to configure and manage Microsoft Defender Antivirus https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/use-powershell-cmdlets-microsoft-defender-antivirus?view=o365-worldwide

Reference : https://learn.microsoft.com/en-us/answers/questions/881655/temporary-disable-pause-defender

I hope this helps!

Kindly mark the answer as Accepted and Upvote in case it helped!

Regards

Answer 2

I have the same issue I keep getting access denied trying to deleted the SERVICE folder or any of the detection history files. I also cannot take ownership of the folder as it is greyed out. What do I do now as I keep getting an old virus notification from defender that does not exist.