If one wants to clear the Defender History or solve the problem with crashing Defender History there is a simple solution.
- Download the AdvancedRun:
for Windows 32-bit: https://www.nirsoft.net/utils/advancedrun.zip
for Windows 64-bit: https://www.nirsoft.net/utils/advancedrun-x64.zip
- Run AdvancedRun.exe once and close it - the file AdvancedRun.cfg will be created
- Edit the config file AdvancedRun.cfg as it is shown below
- Run AdvancedRun.exe to clear the Defender History
After running AdvancedRun it will automatically apply the settings and command lines from the AdvancedRun.cfg and the Defender History will be cleared.
The modified content of AdvancedRun.cfg is as follows:
Code:
...
EXEFilename=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
CommandLine=net stop windefend; $path = 'c:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db'; if (Test-Path -Path $path) {Remove-Item $path}; $path = 'c:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory'; if (Test-Path -Path $path) {Remove-Item $path -Recurse}; net start windefend
AutoRun=1
...
RunAs=8
...
The PowerShell is executed with CommandLine.
AutoRun=1 means that AdvancedRun does not show the application window and automatically applies the AdvancedRun.cfg
RunAs=8 means that the process will be run with TrustedInstaller privileges.
The CommandLine simply stops Windefend service, checks if the file/folder exists and deletes it, starts Windefend service again.
Post edited.
