Windows Defender logs location in Windows 11/10

You might wonder if Windows Defender can store log files of the offline scan. Well, as far as we know, the popular anti-virus and malware scanner does not do such a thing, but there is something else if you want to gain access to valuable data. Now, if you really want to see the results of the offline scan, we can help with that, no problem and at no cost.

It‘s probably not possible to download the data, but at least you can view it and then decide what to do with the information. 

How to see Windows Defender Offline scan results

If you are looking to view the Windows Defender Offline scan results or log, then this information should help a great deal in your quest.

1] Support

One of the easiest ways to locate the log file for Windows Defender is to navigate to the following location and snoop around-

C:\ProgramData\Microsoft\Windows Defender\Support

That’s the easiest way, but it doesn’t show everything you might need, so we will discuss other ways.

2] Event log

You might know this, but several things are shown in the Event Log, including data from Windows Defender offline scan. To get over to that section, we suggest firing up the search box, then copy and paste the following command and hit the Enter key on your keyboard. 

%windir%\System32\winevt\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx

That should deliver some more needed information, at least, so go on ahead and navigate there when ready. 

Alternatively, you could right-click on the Start button, and from there, select Event Viewer.

Then go to Event Viewer > Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational. 

After doing all of that, the user should now see the following: 

• Windows Defender scan has started. (Event ID 1000)
•  Windows Defender scan has finished. (Event ID 1001)
•  Windows Defender signature version has been updated. (2000)

Here, you can check the logs.

Read: Log files created when you upgrade Windows

3] How to find scan results

OK, so when it comes down to scan results, things might get a little bit tricky, but not impossible. What you’ll want to do is right-click on the Start button again, then select Settings > Update & Security > Windows Security > Virus & threat protection. 

From this section under Virus & threat protection, the user should select any of the Threat History options, and that’s it basically. 

The logs are usually used by system admins or to submit errors or problems with Windows Defender.

Now see: Read Windows Defender Event Log using WinDefLogView.