Windows Defender Not Showing History Actions

Protection History in Windows Security is empty when Defender has no recent detections, the Security Center service or Defender platform is stuck, or old events have aged out; if you need old entries, check Event Viewer before deleting anything. A bad cleanup can erase evidence of past threats or leave the page blank by removing the wrong files. Here’s how to tell the difference and fix the least risky cause first.

What a missing history usually means

Windows Security is built into Windows 10 and Windows 11, and its Protection history page is commonly used to view threat actions and service alerts. It typically shows Microsoft Defender Antivirus results as cards, including malware detections, quarantine, blocks, removals, and some remediation failures.

That page can look empty for more than one reason. The first check is simple: is the page missing, blank, or only showing older cards that have already aged out of the two-week retention window?

Likely causes

• Most common: older entries expired normally after two weeks.
• Also common: the Windows Security app needs a refresh or update.
• Less commonly: standard user access is hiding full threat details.
• Less commonly: The Defender service or its cache data may be stuck.

Protection history troubleshooting matrix

Use this matrix before changing files. Start with the least risky fix that matches the symptom, then move to cleanup only if the page still fails to show current entries. If a row mentions escalation, that is the point where file removal becomes a last resort rather than the first move.

How do you check Windows Defender history?

The Protection history page lives in the Windows Security app. Open it first, then inspect the cards before deciding that anything is broken. Red cards mean a serious item; yellow cards mean a non-urgent item. Cards can be expanded for details, and some threat details require administrator privileges.

1. Open Windows Security.
2. Select Virus & threat protection.
3. Open Protection history.
4. Check whether the entries are red or yellow cards.
5. Expand one card to read the action, status, and any remediation note.
6. If details are hidden or limited, sign in with an administrator account and reopen the page.

Say your laptop shows a yellow card for a potentially unwanted application, but the details panel only shows a short summary. That usually points to limited access, not a broken page. Sign in with admin privileges and reopen the same card before doing anything more invasive.

Why is Protection History missing or blank?

A blank page does not always mean corruption. The most common explanation is that Defender has no recent detections, or the entries you expected are older than two weeks and have already aged out. A second possibility is that the app or Defender platform needs a refresh after an update or restart.

Another common difference is between a truly missing page and a page that opens but shows little data. Limited access can hide some threat details, while a stuck Defender service can leave the page stale until Windows reloads it. Check current activity before assuming the cache is damaged.

If history expired after the retention window

1. Open Windows Security > Virus & threat protection > Protection history.
2. Compare the date of the last visible card with the last two weeks of activity.
3. Open Event Viewer and review Defender-related events if you need older records.
4. Do not delete files just because older cards are gone; that can be normal.

If Windows Security needs a refresh or update

1. Open Settings > Apps > Installed apps.
2. Find Windows Security.
3. Open Advanced options.
4. Select Repair; if that does not help, select Reset.
5. Restart Windows and check Protection history again.

If standard user access is limiting details

1. Sign out of the current account.
2. Sign in with an administrator account.
3. Open Windows Security > Virus & threat protection > Protection history.
4. Expand the same card again and compare the detail panel.

If Defender service or cache data is stuck

1. Restart the PC first.
2. Reopen Windows Security > Protection history.
3. If it is still blank, open Event Viewer and check Defender logs for recent alerts.
4. Only if current detections are missing there too, move to file cleanup.

How can you remove Defender history files?

Use file removal only after the safer checks fail. The cleanup method targets C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\*, related mpcache files under C:\ProgramData\Microsoft\Windows Defender\Scans, and mpenginedb.db in the same Defender Scans path. Microsoft Defender Antivirus may lock them while the service is active.

Delete the files with the least risk

1. Open Windows Security > Virus & threat protection > Manage settings.
2. Turn off Real-time protection.
3. Turn off Cloud-delivered protection.
4. Open File Explorer and go to C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\*.
5. Delete the contents in that folder.
6. Go to C:\ProgramData\Microsoft\Windows Defender\Scans and delete the mpcache files and mpenginedb.db.
7. Restart the PC, then reopen Protection history.

Picture a desktop where Protection history stays blank, and Explorer says one of the files is in use. That usually means Microsoft Defender Antivirus Service still has a lock on the folder. A reboot often clears the lock; if it does not, use Command Prompt as the next step.

If Explorer says the files are in use

1. Close Windows Security and File Explorer.
2. Open Command Prompt as an administrator.
3. Run the delete command for the DetectionHistory path and the Defender Scans files.
4. Restart the PC immediately after deletion.
5. Turn Real-time protection and Cloud-delivered protection back on when the page is checked again.

Why won’t I delete the Defender history files?

Deletion usually fails because Microsoft Defender Antivirus Service is still using the folder, or because the current account lacks permission to remove files in ProgramData. That lock is normal while Defender is active, which is why cleanup belongs near the end of the process, not at the start.

Fix locked-file deletion first

1. Restart Windows.
2. Open Windows Security and turn off Real-time protection and Cloud-delivered protection only if cleanup is still needed.
3. Try deleting the folder again from C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\*.
4. If the error returns, use an administrator Command Prompt.
5. Turn the protection settings back on after the files are removed.

Why does Protection History disappear after a while?

The most common reason is normal retention. Protection history keeps events for two weeks, so older cards fall out on their own. That is not the same as a broken page. A real problem is more likely when recent detections vanish, current alerts do not appear, or the page stays blank after a restart. (Microsoft Support)

A common first-timer mistake is deleting cache files the moment the page looks shorter than before. If the only missing entries are older than two weeks, no cleanup is needed. Check current detections first, then decide whether the page is actually stale.

Still not working?

If the page is still empty after an app reset, a restart, and a careful file cleanup, the next step is to inspect Defender logs in Event Viewer and confirm that Windows Security is current. If the problem returns after every reboot, file corruption or policy restrictions may be involved.

1. Recheck Windows Security > Protection history after every restart.
2. Review Event Viewer for recent Defender entries.
3. Confirm you are using an administrator account.
4. If the page still fails, contact your device vendor or a Windows support channel for policy and repair help.

Prevention

Keep Windows Security updated and avoid turning off Defender protection unless you are actively cleaning locked history files. That reduces the chance of a stale page and keeps the two-week history visible when current detections are present.

Related: Windows Defender Not Showing in Hidden Icons

Frequently asked questions

Why is Windows Defender protection history missing or blank?

Most often, there are no recent detections or the entries have aged out after two weeks. If the page still should show recent alerts, reset the Windows Security app first. If that fails, check Event Viewer before touching files in the Defender Scans folder.

How can I remove Windows Defender history?

Use the file reset only after safer checks fail. Turn off Real-time protection and Cloud-delivered protection, then delete the contents of C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\* and the related mpcache files. Restart Windows after the cleanup.

How do I delete Windows Defender detection history?

Open File Explorer to C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\*, delete the contents, then remove mpenginedb.db and any mpcache files under C:\ProgramData\Microsoft\Windows Defender\Scans. If Explorer says the files are in use, retry from an administrator Command Prompt after a reboot.

Do I need admin rights to view Protection History?

Yes for full details. Protection history can open for a standard user, but Microsoft says administrator privileges are required to review threat details. If a card looks sparse, sign in with an admin account and reopen the same entry before assuming the data is gone.