Windows Security Protection History: Check a Blocked File Safely

When Windows blocks a download or flags a file, start by reviewing Windows Security Protection History. It can show what Microsoft Defender Antivirus detected and the action taken. Your goal is to identify the affected item, establish where it came from, and decide whether further review is justified before changing its protection status.

A false positive is a legitimate file incorrectly classified as a threat. A familiar filename or a promise from the download page does not establish that a detection is a false positive. Keep the file blocked or quarantined while you check the evidence.

Before you begin

• Have the approximate alert time and original download source available.
• Use an account authorized to review the device. Administrator privileges are required to view threat details.
• On a work or school PC, involve IT when settings are managed or the file contains organizational information.
• Do not open the suspect file, run its installer, or enable document macros as a verification method.

The review applies to Windows 11 and Windows 10. Searching Start for Windows Security works on both, as described in Microsoft’s Windows Security guide. Ordinary Windows 10 support ended October 14, 2025; check your device’s applicable update coverage using Microsoft’s Windows 10 support information. Reviewing an alert does not replace operating-system security updates.

Review and verify the blocked file in five steps

Step 1: Open Protection History and identify the event

Open Start, search for Windows Security, and open the app. Select Protection history; you can also reach it from Virus & threat protection. Expand the relevant event card and approve an administrator prompt only if you initiated this action.

Record the detection name, status, time, and affected file path where displayed. Match these to the download you are investigating. Microsoft’s Protection History documentation says events remain visible for only two weeks, so save relevant details promptly.

Expected result: you can identify the event and affected item. If there is no matching entry, use the missing-history checks below.

Step 2: Read the status before selecting an action

The status describes what happened; it is not a verdict that the file is safe.

Quarantine means isolating a detected item so it cannot be used normally. A potentially unwanted application (PUA) is software with unwanted behavior, such as intrusive advertising or bundled software; that classification is different from a malware detection, but it still deserves review.

If the warning appeared in Microsoft Edge, press Ctrl+J to review Downloads, a shortcut listed in Microsoft’s Edge shortcut reference. SmartScreen screens downloads using known threats and reputation signals. An uncommon-download warning does not establish the same facts as an antivirus detection. Read the exact warning and keep it in place while investigating; see Microsoft’s SmartScreen explanation.

Expected result: you know whether you are investigating an antivirus event, a PUA block, or a browser warning.

Step 3: Check the source, signature, and hash without launching the file

First confirm that the download came from the publisher’s genuine website or another distribution channel the publisher identifies. Check the product, version, and intended Windows architecture. If the download originated in an unexpected message or advertisement, navigate independently to the publisher’s site instead of following the same link again.

Ask the publisher whether the specific version has a known detection issue and whether a corrected installer is available. A support reply should refer to the actual version and detection you recorded.

If the file remains accessible: the optional Windows PowerShell commands below inspect its signature and contents without launching the program. Replace the quoted example path with the exact path to your file. If access is denied or the file is already quarantined or removed, skip these commands and request help. Do not restore it merely to obtain a hash.

Check the digital signature. An Authenticode signature identifies the signing publisher and helps validate signed content. Open Windows PowerShell and run:

Get-AuthenticodeSignature -LiteralPath 'C:\Path\To\File.exe' |
    Format-List Status, StatusMessage, SignerCertificate

The output includes signature status and certificate information. Compare the signer with the expected publisher. Valid indicates successful signature validation, not a guarantee that the software is harmless. An unsigned file also is not automatically malicious; it has less signature evidence to evaluate. Stop if the signer is unexpected or validation fails. Microsoft describes the command in its Get-AuthenticodeSignature documentation.

Compare a SHA-256 hash. A hash is a fingerprint calculated from a file’s contents. Run:

Get-FileHash -LiteralPath 'C:\Path\To\File.exe' -Algorithm SHA256

Compare the full SHA-256 value with one published through the developer’s trusted channel for the exact same file and version. A mismatch means the files differ. A match supports file identity, not safety, and a hash copied from an untrusted download page adds little confidence. If the publisher provides no trusted comparison value, the calculated hash can still identify the sample when contacting support. See Microsoft’s Get-FileHash documentation.

Expected result: you have documented source and identity evidence, or identified that verification needs help. You have not run the file or created an antivirus exception.

Step 4: Update security intelligence and scan an accessible file

Security intelligence means the threat information used by Defender. In Windows Security, open Virus & threat protection > Protection updates > Check for updates. Let the update check finish before scanning again.

For an accessible file, right-click it in File Explorer. On Windows 11, select Show more options if needed, then Scan with Microsoft Defender. On Windows 10, look for that scan action in the file’s context menu. Microsoft’s file-scanning instructions documents the file and folder scan command.

If that command is unavailable, check the active antivirus provider in Windows Security under Virus & threat protection > Manage providers, where offered. Another antivirus product may be responsible; use its supported scanning workflow or ask IT. Avoid installing competing antivirus products just for this check.

Expected result: a completed scan report for the accessible item. A report with no detected threats is useful evidence, but it is not a certification of safety. If Defender quarantines the file during scanning, leave it contained and record the new event.

Updating intelligence changes Defender’s detection data; scanning can quarantine or remove detected content. Neither requires clearing browsing data or disabling protection. Keep real-time protection enabled. Microsoft’s Virus & threat protection guide explains updates, scan options, and their effects.

Step 5: Resolve uncertainty before considering an exception

If the source is uncertain, verification fails, or the detection remains unexplained, leave the item blocked. For software you need, request a corrected package or a documented review from its publisher or your IT team.

You can report a suspected false positive through the Microsoft Security Intelligence submission portal. Include the detection name, software version, source, and hash if available. Submitting a file uploads its contents to Microsoft for analysis, so obtain the appropriate authorization for confidential or organizational material. If quarantine prevents access to the sample, ask IT or the publisher to handle the submission.

For an Edge download warning, the download alert’s menu may offer Report this file as safe, as described in Microsoft’s download feedback instructions. This requests review; it does not itself prove the file is safe.

Restore releases a quarantined file and can lead to another detection. Allow on device changes how Defender handles the threat; it is not a verification test. A file already removed is not recovered by allowing it. Consider such an exception only after the specific file has been assessed and approved. A broad Downloads-folder exclusion would also leave unrelated files outside normal real-time checks.

Expected result: the item stays contained, is replaced with a verified corrected download, or has a documented decision for that specific file.

What if Protection History is empty or the warning keeps returning?

Check the warning’s origin and the active antivirus provider. Edge download warnings and organization policies are not interchangeable with Defender Antivirus events. An older event may have aged out of the two-week history window. An empty list therefore does not establish that a file was never blocked or is safe.

If remediation is incomplete or a detection repeatedly returns, record the affected paths and contact IT or Microsoft Support. A full system scan may be appropriate when the issue extends beyond one download. Do not delete security-history folders or change registry settings to make an alert disappear; that removes useful context without verifying the file.

How do you undo an accidental Allow decision?

Open Windows Security > Virus & threat protection > Allowed threats. Select the relevant entry and choose Don’t allow. This removes that permission so Defender can act when it encounters the threat again. It does not reverse actions a program has already performed. Run an appropriate scan afterward and seek help if the file was executed.

A successful review leaves you with the exact event, a known file source, documented identity checks where possible, and a reasoned action. Keeping an unresolved item quarantined is a valid outcome.