Windows Defender Advanced Threat Protection log file

Question

The log file for Defender ATP is filling up my C Drive on one of my Windows servers, it is 27Gb.

Location C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Temp

Is there any way to configure what is logged, and/or a max size for the log file?

Answer 1

Hi anonymous user-2419

Thank you for posting your question to Microsoft Q&A forum.

How did you configure your Windows Defender Advanced Threat Protection? SCCM? Intune?

You can also try contacting Microsoft Defender for Endpoint support:
https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/contact-support?view=o365-worldwide

Best Regards,
Wesley Li

Answer 2

Hi,

Windows defender files will appear in disk clean up if you click the clean up system files option. This will tidy it up for now.

There’s no configuration options for what’s logged but if it’s producing so many logs, there’s likely to be something wrong. Have you checked the logs to see if you can remove files or change something else on the server to prevent them being created in the first place?

I hope this answers your question.

-------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept as answer--

Answer 3

Hello

Do you have any other questions?

If the above reply is helpful to you, please mark it as answer.

Thanks