Question Windows Defender protection history crashing

[Arbiter051]

I am really sorry if this isn't the place to post this.

This happened just today. When I go to open the protection history it crashes. After some googling it seems that this has been a problem for quite some time and it is caused by the history becoming too full. I found this post on reddit.

SOLUTION:

del "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\*"

del "C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db"

NOW IF THIS DOES NOT WORK:

Go to this folder: C:\ProgramData\Microsoft\Windows Defender\Scans
and edit the file mpenginedb.db with notepad++

NOT THE NORMAL NOTEPAD!!!! YOU NEED TO USE NOTEPAD++

https://notepad-plus-plus.org/downloads/

EDIT IT BY SIMPLY MARKING ALL THE TEXT IN THE FILE AND DELETING IT

Ctr-a then delete the text

Press ctr-s when you are finished

link


I tried all of this and it did not fix the problem. I tried disabling defender in the registry temporarily so I could delete the folder you edit with notepad++ completely, but when I restarted my pc, it was still running and the new key I made "DisableAntiSpyware" was deleted and not there. I guess we can't even do that anymore?

Can anyone help me out to solve this problem please? Thank you very much!

[mod edit: formatting]

 

[Colif]

i changed how the reddit post showed

Did you try this = https://answers.microsoft.com/en-us/windows/forum/all/protection-history-crashes/e6d54506-4712-4bb0-88bc-8b518b3d8bf0

 

[Arbiter051]

i changed how the reddit post showed

Did you try this = https://answers.microsoft.com/en-us/windows/forum/all/protection-history-crashes/e6d54506-4712-4bb0-88bc-8b518b3d8bf0

Sadly that was the first thing I tried and it did not help.

I am sorry if I posted the Reddit link wrong.

 

[Colif]

reddit links just show strange, its just how forums deal with them by default.

did you run sfc /scannow?

curious if there are any events tied to this problem.

I did some reading and it seems after it gets too full of protection history events it craps out.

found this from
https://www.thewindowsclub.com/clear-windows-defender-protection-history

You can specify a different delay period (in days) by running the cmdlet below in PowerShell admin mode (press Win+X and then tap A on the keyboard):

Set-MpPreference -ScanPurgeItemsAfterDelay 1
The specified number 1 is the number of days after which the protection history log and items in the log folder will be cleared.

solved it for me immediately, has been an issue for weeks now.

https://answers.microsoft.com/en-us/windows/forum/all/windows-defender-protection-history-crash/50955953-2b86-455c-b184-c781948f1aba

 

[Arbiter051]

Just did it and it found nothing. I did it as an admin as well.

to the Reddit post: ah gotcha that is fair.

thankfully defender still works from what I can tell. It’s just harder and more annoying to to add stuff to the exception list of need be.

edit: i got it! Had to delete the history stuff a third time and I also found a video from britec09 that shows clearing the cache in event viewer.

Edit 2: never mind. I got the history to show but it wouldn’t let me clear the filters. I closed it and reopened it to confirm it wasn’t a fluke and it’s crashing again.

 

[Colif]

windows 10 and 11 are struggling under the weight of 1 years worth of updates. Windows update appears to break a lot more now, and defender would be tied into that as well.
There should be a new version of windows 10 next month so that could fix this.

I assume this was video

here are 4 ways - https://www.makeuseof.com/windows-microsoft-defender-clear-history/

 

[Arbiter051]

Yea that is the video. If it is a windows update that would both make sense and make me irked but it is what it is.

I am not sure what else I can do because it wouldn’t even let me clear the filters. My reliability checker has so many errors because I’ve tried to open the history so many times haha.

 

[Colif]

there is one thing that probably would fix it and it doesn't take that long to do.
https://www.tenforums.com/tutorials/16397-repair-install-windows-10-place-upgrade.html

all it does is replaces windows with a new copy. Everything else should be exactly as it is now
takes at most an hour to install and get all the updates.

 

[Arbiter051]

there is one thing that probably would fix it and it doesn't take that long to do.
https://www.tenforums.com/tutorials/16397-repair-install-windows-10-place-upgrade.html

all it does is replaces windows with a new copy. Everything else should be exactly as it is now
takes at most an hour to install and get all the updates.

I thought of that but man it sounds like such a pain. It would be nice if Microsoft would just fix whatever is causing this issue.

 

[Colif]

its not that hard, I had to do one a few weeks ago on win 11. I used step 5 method which involves making a win 11 installer in my case and just running the installer again. It is pretty easy. Need to remove any 3rd party AV before you start, and Malwarebytes as well.

One other thought I had was try making a new user and see if it can get any further - https://support.microsoft.com/en-us/windows/create-a-local-user-or-administrator-account-in-windows-20de74e0-ac7f-3502-a866-32915af2a34d
make local user & make it admin. Log in and see if it can get into screens... its just a test to see if the user profile is the problem.

 

[Arbiter051]

My issue with doing the repair method is I would have to change all my settings inside windows again and I am lazy heh

I can try the user account method later when I get home.

one thing I haven’t been able to try is deleting the folder you can edit with notepad++. Is there software I can use to brute force delete it? I remember something called unlocked but that was years ago.

 

[Colif]

what settings? it doesn't change anything apart from your windows files.

tried deleting folder in safe mode?

 

[Arbiter051]

what settings? it doesn't change anything apart from your windows files.

tried deleting folder in safe mode?

Sadly defender runs in safe mode so it won’t let me.

wouldn’t the repair undo my changes in device manager and services etc? Some services are a pain to turn off.

edit: okay so something interesting. After a restart and doing a bunch of methods. I can get into the protection history so it is working, however I can’t clear any of it (there is a lot!) so once I exit out, it crashes until I restart the process.

i am not sure what I am doing wrong but the history will not clear. I did do the set preference method to delete the history every 7 days so maybe that will work. But I am not sure what else to do.

 

[Colif]

Do version updates replace those settings?? A repair install is basically a version update.
So if you have to change settings everytime you get a version update (previous to this year you got one every 6 months), then you would have to after a repair install.
Otherwise, you should be fine.

You could probably delete file using command prompt in windows recovery but I don't know what commands you would use.

 

[Arbiter051]

Do version updates replace those settings?? A repair install is basically a version update.
So if you have to change settings everytime you get a version update (previous to this year you got one every 6 months), then you would have to after a repair install.
Otherwise, you should be fine.

You could probably delete file using command prompt in windows recovery but I don't know what commands you would use.

The whole issue here is that there is no way for me to delete the controlled folder access inquiries in protection history.

if I could figure out how to delete those my problem would be solved I think.

 

[Colif]

some of the answers in this thread might help = https://www.tenforums.com/antivirus-firewalls-system-security/133451-clear-windows-security-center-defender-protection-history.html

 

[Arbiter051]

some of the answers in this thread might help = https://www.tenforums.com/antivirus-firewalls-system-security/133451-clear-windows-security-center-defender-protection-history.html

The issue sadly is that non of this clears the controlled folder access protection history. All the entries still remain.

I am totally lost as to how Microsoft could have this high of an oversight. At least that is how it seems.

 

[Colif]

i don't use defender so I can't look at how many I might have. Its possible the version update of win 10 that should be out next month will clear that history page completely.

I don't have anything more I can offer. You could ask on tenforums as if I am stuck with something, I ask on there. Someone there might have an answer for you.

 

[Arbiter051]

i don't use defender so I can't look at how many I might have. Its possible the version update of win 10 that should be out next month will clear that history page completely.

I don't have anything more I can offer. You could ask on tenforums as if I am stuck with something, I ask on there. Someone there might have an answer for you.

No worries Colif thank you for trying. I assume you use bitdefender free? You recommend that to me before.

I use to use that when they had the old version.

 

[Colif]

i use the paid version. They released a new version of free, it doesn't have problems last one did.
Its essentially same client as the total Security version, just with things disabled.
https://www.bitdefender.com.au/solutions/free.html

 

[Arbiter051]

i use the paid version. They released a new version of free, it doesn't have problems last one did.
Its essentially same client as the total Security version, just with things disabled.
https://www.bitdefender.com.au/solutions/free.html

Ah gotcha. Yea might soon be time to make the switch back. This is a little ridiculous haha.

 

[Colif]

My protection history page is blank, so thats one advantage I guess.

 

[Arbiter051]

My protection history page is blank, so thats one advantage I guess.

Yes well… that is a good advantage to have as well. As much as people praise who good defender is now, I’m starting to rethink it.