Can't Restore Quarantined Files in Windows Defender? [5 Proven Fixes for Windows 10/11]

About Quarantined Files in Windows Defender

Windows Defenderis the built-in security tool in Windows that protects your PC from viruses, malware, and other threats. When Defender detects a suspicious file, it may "quarantine"it instead of deleting it immediately. This can help prevent infectionswhile giving you a chance to review detected threats, as well as avoid "accidentally deleting important files".

What Does "Quarantined" Mean?

• A "quarantined file"is moved to a secure, isolated folder where it can’t harm your system.
• You can "restore"it if it’s a false positive (a safe file mistakenly flagged as malware).
• If the file is truly malicious, you can "permanently delete" it from quarantine.

Generally, the quarantined files are kept in a hidden, encrypted folder "C:\ProgramData\Microsoft\Windows Defender\Quarantine"and can only be accessed via "Windows Security settings"or "PowerShell/CMD commands".

Can’t Restore Quarantined Files in Windows Defender? Why?

Windows Defender may sometimes mistakenly flag safe files as threats (false positives). If a trusted program or important file gets quarantined, you’ll need to restore files from Windows Defender. However, sometimes the "Windows Defenderquarantine restore not working" issue occurs, Why? Possible reasons include:

1. File Deleted from Quarantine – Defender may have automatically purged old threats.

2. Lack of Admin Permissions – Requires elevated rights to restore.

3. Real-Time Protection Blocking– Defender might re-detect and block the file again.

4. Corrupted Quarantine Database – Windows Defender’s quarantine storage could be damaged.

5. File in Use by System – If locked by another process, restoration fails.

Methods to Restore Quarantined Files from Windows DefenderSuccessfully

If Windows Defender quarantines a file but doesn't allow you to restore it,you can take the following steps based on the possible causes mentioned above.

Method 1: Disable Real-Time Protection Temporarily to Restore Quarantined Files

If Windows Defender blocks you from restoring a quarantined file, temporarily disabling Real-Time Protection can help restore files without interference. This prevents Defender from re-detecting and blocking the file during restoration.

Step 1: Press "Win + S", type "Windows Security", and open it.

Step 2: Click"Virus & threat protection" and then "Manage settings".

Step 3: Toggle off "Real-time protection". If prompted by UAC, click "Yes".

Then, check whether you can restore the quarantined files from Windows Defender: In Windows Security, click "Protection history". Under, locate the file under "Quarantined items" and click "Actions -> Restore". If you restore the items successfully, remember to re-enable Real-Time Protection afterward to keep your system secure.

Method 2: Restore Quarantined Files Using CMD (Admin)

If the "Restore" button is grayed out in Windows Security and prevents you from recovering quarantined files, you can manually restore them using Command Prompt (CMD).

Step 1: Press "Win + X", then select "Terminal (Admin)" or "Command Prompt (Admin)". If prompted by UAC, click "Yes".

Step 2: Run the following command to view all quarantined items:

"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Restore -ListAll

Note the "Threat Name" of the file you want to restore.

Step 3: Then run the following command, replacing "" with the actual name from Step 2:

"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Restore -Name

Method 3: Restore Quarantined Files Using PowerShell (Admin)

PowerShell provides advanced control for managing quarantined files in Windows Defender. When you cannot restore quarantined files in Windows Defender, this method can be a workaround.

Step 1: Press "Win + X`", then select "Windows PowerShell (Admin)".

Step 2: Run the following command to "display all quarantined items":

Get-MpThreatDetection | Where-Object { $_.ActionsTaken -match "Quarantine" } | Format-Table -AutoSize

Remember the ThreatName of the file(s) you want to restore.

Step 3: Run the following command, replacing "Name" with the actual name from Step 2 to restore the quarantined file.

Restore-MpThreatDetection -Name

Method 4: Run Windows Defender Offline Scan

If the quarantine database is corrupted, the Windows Defender quarantine restore might not working. Thus, you can perform an offline scan.

Step 1: Open Windows Security and click "Virus & threat protection".

Step 2: Click "Scan options".

Step 3: Select "Microsoft Defender Offline scan" and click "Scan now".

Then your computer will reboot to perform a deep scan. Then check if restoration works.

Method 5: Use Professional Data Recovery Tool

If the above standard restoration methods fail and you still cannot restore quarantined files in Windows Defender, the files may have been permanently deleted. In such cases, using a professional data recovery tool is the most reliable solution.

Here we highly recommend MyRecover. Windows Defender may completely remove certain files from quarantine, making them inaccessible through conventional methods. MyRecover can scan your storage device for residual traces of deleted files and restore them efficiently.

Step 1: Download MyRecover from the official website and install it on your PC.

Step 2: Run the software, choose the disk where the quarantined files were originally stored and click on "Scan".

Step 3: This software will search for recoverable files by a "quick scan" mode first. If the deleted files are not found in this mode, click "deep scan" button at the lower left manually.

Step 4: Check the scan results, select the needed files, and click "Recover".

Step 5: Restore them to a secure location.

Summary

What to do when you cannot restore quarantined files in Windows Defender? Now you should have an idea! By following these steps, you can regain access to your files while keeping your system secure. If the files have been permanently deleted, MyRecover offers the best chance of recovery. Its deep scan technology and broad file support ensure that even lost or corrupted data can be retrieved.

For more sophisticated capabilities including unlimited data recovery and pre-recovery file preview (allowing you to verify files beforehand), the Professional or Technician can satisfy you well.