Can't Restore Quarantined Files in Windows Defender? [5 Proven Fixes for Windows 10/11]

If Windows Defender won’t let you restore quarantined files, you can check out this article, which will not only tell why you can't restore quarantined files Windows Defender, but also demonstrate effective methods to fix "Windows Defender quarantine restore not working" errors in Windows 10/11 with step-by-step guide.

Emma

By Emma / Updated on April 29, 2025

Share this: instagram reddit

About Quarantined Files in Windows Defender

Windows Defenderis the built-in security tool in Windows that protects your PC from viruses, malware, and other threats. When Defender detects a suspicious file, it may "quarantine"it instead of deleting it immediately. This can help prevent infectionswhile giving you a chance to review detected threats, as well as avoid "accidentally deleting important files".

Windows Defender

What Does "Quarantined" Mean?

  • A "quarantined file"is moved to a secure, isolated folder where it can’t harm your system.
  • You can "restore"it if it’s a false positive (a safe file mistakenly flagged as malware).
  • If the file is truly malicious, you can "permanently delete" it from quarantine.

Restore Quarantined Files

Generally, the quarantined files are kept in a hidden, encrypted folder "C:\ProgramData\Microsoft\Windows Defender\Quarantine"and can only be accessed via "Windows Security settings"or "PowerShell/CMD commands".

Can’t Restore Quarantined Files in Windows Defender? Why?

Windows Defender may sometimes mistakenly flag safe files as threats (false positives). If a trusted program or important file gets quarantined, you’ll need to restore files from Windows Defender. However, sometimes the "Windows Defenderquarantine restore not working" issue occurs, Why? Possible reasons include:

1. File Deleted from Quarantine – Defender may have automatically purged old threats.

2. Lack of Admin Permissions – Requires elevated rights to restore.

3. Real-Time Protection Blocking– Defender might re-detect and block the file again.

4. Corrupted Quarantine Database – Windows Defender’s quarantine storage could be damaged.

5. File in Use by System – If locked by another process, restoration fails.

Methods to Restore Quarantined Files from Windows DefenderSuccessfully

If Windows Defender quarantines a file but doesn't allow you to restore it,you can take the following steps based on the possible causes mentioned above.

Method 1: Disable Real-Time Protection Temporarily to Restore Quarantined Files

If Windows Defender blocks you from restoring a quarantined file, temporarily disabling Real-Time Protection can help restore files without interference. This prevents Defender from re-detecting and blocking the file during restoration.

Step 1: Press "Win + S", type "Windows Security", and open it.

Open Windows Security

Step 2: Click"Virus & threat protection" and then "Manage settings".

Manage Setting

Step 3: Toggle off "Real-time protection". If prompted by UAC, click "Yes".

Turn Off Real-time Protection

Then, check whether you can restore the quarantined files from Windows Defender: In Windows Security, click "Protection history". Under, locate the file under "Quarantined items" and click "Actions -> Restore". If you restore the items successfully, remember to re-enable Real-Time Protection afterward to keep your system secure.

Method 2: Restore Quarantined Files Using CMD (Admin)

If the "Restore" button is grayed out in Windows Security and prevents you from recovering quarantined files, you can manually restore them using Command Prompt (CMD).

Step 1: Press "Win + X", then select "Terminal (Admin)" or "Command Prompt (Admin)". If prompted by UAC, click "Yes".

Terminial Admin

Step 2: Run the following command to view all quarantined items:

"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Restore -ListAll

List Quarantined Items

Note the "Threat Name" of the file you want to restore.

Step 3: Then run the following command, replacing "" with the actual name from Step 2:

"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Restore -Name

Restoring Quarantined Items

Method 3: Restore Quarantined Files Using PowerShell (Admin)

PowerShell provides advanced control for managing quarantined files in Windows Defender. When you cannot restore quarantined files in Windows Defender, this method can be a workaround.

Step 1: Press "Win + X`", then select "Windows PowerShell (Admin)".

Powershell

Step 2: Run the following command to "display all quarantined items":

Get-MpThreatDetection | Where-Object { $_.ActionsTaken -match "Quarantine" } | Format-Table -AutoSize

Remember the ThreatName of the file(s) you want to restore.

Step 3: Run the following command, replacing "Name" with the actual name from Step 2 to restore the quarantined file.

Restore-MpThreatDetection -Name

Method 4: Run Windows Defender Offline Scan

If the quarantine database is corrupted, the Windows Defender quarantine restore might not working. Thus, you can perform an offline scan.

Step 1: Open Windows Security and click "Virus & threat protection".

Step 2: Click "Scan options".

Scan Options

Step 3: Select "Microsoft Defender Offline scan" and click "Scan now".

Microsoft Scan Now

Then your computer will reboot to perform a deep scan. Then check if restoration works.

Method 5: Use Professional Data Recovery Tool

If the above standard restoration methods fail and you still cannot restore quarantined files in Windows Defender, the files may have been permanently deleted. In such cases, using a professional data recovery tool is the most reliable solution.

Here we highly recommend MyRecover. Windows Defender may completely remove certain files from quarantine, making them inaccessible through conventional methods. MyRecover can scan your storage device for residual traces of deleted files and restore them efficiently.

MyRecover
One-Stop Data Recovery Solution
  • Deep Scan Technology – Conducts a thorough search and recovers files even after permanent deletion.
  • Wide File Format Support – Restores documents, images, videos, archives, and more (up to 1000+ file types).
  • User-Friendly Interface – Simple steps for quick and full data recovery, suitable for all users.
  • Works in Diverse Scenarios – Recovers files from formatted drives, corrupted partitions, system crashes, and other complex data loss situations.

Step 1: Download MyRecover from the official website and install it on your PC.

Step 2: Run the software, choose the disk where the quarantined files were originally stored and click on "Scan".

Select Drive and Scan

Step 3: This software will search for recoverable files by a "quick scan" mode first. If the deleted files are not found in this mode, click "deep scan" button at the lower left manually.

Step 4: Check the scan results, select the needed files, and click "Recover".

Choose Files

Step 5: Restore them to a secure location.

Choose Destination Location

Summary

What to do when you cannot restore quarantined files in Windows Defender? Now you should have an idea! By following these steps, you can regain access to your files while keeping your system secure. If the files have been permanently deleted, MyRecover offers the best chance of recovery. Its deep scan technology and broad file support ensure that even lost or corrupted data can be retrieved.

For more sophisticated capabilities including unlimited data recovery and pre-recovery file preview (allowing you to verify files beforehand), the Professional or Technician can satisfy you well.

Emma
Emma · Editor
With over 6 years of experience in the field of data recovery, I focus on creating clear, practical, and easy-to-understand articles, guides, and tutorials. My aim is to make the process of computer data recovery simple for everyone, whether you're an experienced user or a complete beginner. I strive to break down complex recovery procedures into straightforward steps, ensuring that anyone can follow along and recover their important files without stress.