Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 954045" data-attributes="member: 32260">I confirmed that the ScanPurgeItemsAfterDelay feature does not remove most PUA (low severity) and ASR related records in the Defender History. But, it can probably remove some serious threats related to Id=1116.So, this feature works differently from:<ul>
<li data-xf-list-type="ul">deleting &quot;c:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db&quot;</li>
</ul>and<ul>
<li data-xf-list-type="ul">deleting the folder: 
&quot;C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\&quot;</li>
</ul>I found on my machine a few events Id=1013 :[ATTACH=full]260062[/ATTACH]As we can see, the difference between the date of deleting History event and the date of detection is 15 days (default delay). So, it seems that some records were removed from Defender&#039;s History by the&nbsp; ScanPurgeItemsAfterDelay feature.From the description, this event should be related to deleting Defender&#039;s History (malware and PUA). Anyway, it does not delete all PUA, because I can still see some older PUA records in the Defender History.</blockquote>

[QUOTE="Andy Ful, post: 954045, member: 32260"] I confirmed that the ScanPurgeItemsAfterDelay feature does not remove most PUA (low severity) and ASR related records in the Defender History. But, it can probably remove some serious threats related to Id=1116. So, this feature works differently from: [LIST] [*]deleting "c:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db" [/LIST] and [LIST] [*]deleting the folder: "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\" [/LIST] I found on my machine a few events Id=1013 : [ATTACH type="full" alt="1628379097577.png"]260062[/ATTACH] As we can see, the difference between the date of deleting History event and the date of detection is 15 days (default delay). So, it seems that some records were removed from Defender's History by the ScanPurgeItemsAfterDelay feature. From the description, this event should be related to deleting Defender's History (malware and PUA). Anyway, it does not delete all PUA, because I can still see some older PUA records in the Defender History. [/QUOTE]

Verification