Windows Defender creating thousands of files

Denis Payne 156 Reputation points
2021-04-30T09:58:44.31+00:00

Since 28/04/2021 around 22:00, thousands of files started to be created in folder C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\ on one of my domain controllers.

There were over 200k files which caused that night's backup to take over 4hours rather then the normal 20minutes.
There are now well over 400k files.

Another member server is also affected by this, there are over 2million files in the same folder being:
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\

Bother servers are running Windows Server 2016.
The files are 1-2KB.
Settings>Update&Security>Windows Defender settings are enabled.
Windows Defender GUI>History is empty for Quarantined, Allowed and All Detected items.
No Windows Defender scan is running.

Resource Monitor>Disk>Disk Activity shows the System process accessing these files, so I presume it is creating them.
System is also the owner of these files.

Windows Server 2016
Windows Server 2016
A Microsoft server operating system that supports enterprise-level management updated to data storage.
2,368 questions
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,105 questions
Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,721 questions
Accepted answer
  1. Denis Payne 156 Reputation points
    2021-05-10T10:58:39.867+00:00

    All in 7xWS2016 servers all running Sophos were affected, across two of my clients.
    Windows Defender was thus uninstalled from 3xservers with small C-Drives to prevent 0% free space issue.

    Cause seems to of been a MSFT Windows Defender update for which a fix was released late last week.

    Windows Defender has been re-installed on the 3xservers it was previously uninstalled from.
    None of the 7xWS2016 servers are showing a repeat of the issue so assume MSFT fixed it with a Windows Defender update.

    1 person found this answer helpful.
    0 comments

10 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Yuhan Deng 3,761 Reputation points Microsoft Vendor
    2021-05-03T07:00:55.837+00:00

    Hi,
    Based on your description, I did some research but got nothing. To resolve this issue, I would suggest that you contact Microsoft Customer Support and Services where more in-depth investigation can be done so that you would get a more satisfying explanation and solution to this issue. In addition, if the issue has been proved as system flaw, the consulting fee would be refund. You may find phone number for your region accordingly from the link below.
    Global Customer Service phone numbers:
    https://support.microsoft.com/en-us/help/13948/global-customer-service-phone-numbers

    Thanks for your time.
    Best regards,
    Danny

    -----------------------------

    If the Answer is helpful, please click "Accept Answer" and upvote it.

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    1 person found this answer helpful.
    0 comments
  2. David Fosbenner 21 Reputation points
    2021-05-05T16:48:08.343+00:00

    I've seen in other threads that a fix may come Thursday. I'm not waiting around. I removed WD from my servers and it will be part of my new build checklist to remove it whenever a server has 3rd party AV. Problem solved.

    0 comments