Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 953721" data-attributes="member: 32260">
<ol>
<li data-xf-list-type="ol">Deleting the folder: 
&quot;C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\&quot; 
removes the detection events from Defender&#039;s History. But, blocked events like those related to ASR rules are not removed. The ConfigureDefender Log does not change at all.</li>
<li data-xf-list-type="ol">Emptying the Event Log:</li>
</ol>[ATTACH=full]260028[/ATTACH]... removes all entries from ConfigureDefender&#039;s Log but does not remove any entries from Defender&#039;s History.********************************************There is a way to clear the Defender History. One has to stop temporarily Defender service and:<ol>
<li data-xf-list-type="ol">Delete the file: &quot;c:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db&quot; 
This will remove the ASR entries from Defender&#039;s History.</li>
<li data-xf-list-type="ol">Delete the folder: 
&quot;C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\&quot; 
This will remove other entries from Defender&#039;s History.</li>
</ol>Stopping Defender service requires Trusted Installer privileges, so one has to use Defender Control (Sordum.org) or <s>AdvancedRun (Nirsoft.net)</s>.One can remove these files also using the recovery CMD shell.Edit1.I noticed that it is not necessary to delete all files and subfolders in the folder:&quot;C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\&quot;Deleting the subfolder &quot;DetectionHistory&quot; is enough.Edit2 (August 2022)Advanced Run method is currently blocked by Defender.</blockquote>

[QUOTE="Andy Ful, post: 953721, member: 32260"] [LIST=1] [*]Deleting the folder: "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\" removes the detection events from Defender's History. But, blocked events like those related to ASR rules are not removed. The ConfigureDefender Log does not change at all. [*]Emptying the Event Log: [/LIST] [ATTACH type="full" alt="1628108787124.png"]260028[/ATTACH] ...[B] [COLOR=rgb(0, 168, 133)]removes all entries from ConfigureDefender's Log[/COLOR][/B] but does not remove any entries from Defender's History. ******************************************** [B]There is a way to clear the Defender History[/B]. One has to stop temporarily Defender service and: [LIST=1] [*]Delete the file: "c:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db" This will remove the ASR entries from Defender's History. [*]Delete the folder: "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\" This will remove other entries from Defender's History. [/LIST] Stopping Defender service requires Trusted Installer privileges, so one has to use Defender Control (Sordum.org) or [S]AdvancedRun (Nirsoft.net)[/S]. One can remove these files also using the recovery CMD shell. Edit1. I noticed that it is not necessary to delete all files and subfolders in the folder: "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\" Deleting the subfolder "DetectionHistory" is enough. Edit2 (August 2022) Advanced Run method is currently blocked by Defender. [/QUOTE]

Verification