This post shows students and new users steps to change how long Windows Security Protection history events are retained in Windows 11.
The Protection history page in the Windows Security app is where you can go to view actions that Microsoft Defender Antivirus has taken that includes, Potentially Unwanted Apps that have been removed, or key services that are turned off.
By default, Protection history only retains events for two weeks, after which they’ll disappear from this page.
You can change how long to keep or retain items in he scan history folder, after which, Microsoft Defender removes expired events.
If you specify the value zero ( 0 ), events are never automatically removed by retain indefinitely.
Below is how to change how long Protection history event are kept in Windows Security app when using Windows 11
How to change Windows Security Protection history events removal in Windows 11
As mentioned above, Protection history only retains events for two weeks, after which they’ll disappear from this page.
However, you can change how long to keep or retain Protection history events or choose not to automatically remove them.
Below is how to do that:
Using PowerShell, open as administrator, then run the commands below to view the current purge settings for Protection history in Windows Security.
Get-MpPreference | Select-Object -Property ScanPurgeItemsAfterDelay
By default, it’s set to 15.
To change how to change how long Protection history events are retained, run the commands format below:
Set-MpPreference -ScanPurgeItemsAfterDelay <days>
Replace <days> with the number of days to retain Protection history events.
- 15 days = Default.
- 0 days = Protection history events will not automatically be removed.
The screenshot below show a a command to retain the Protection history events for 100 days.
That should do it!
Conclusion:
This post showed you how to change how long Windows Security Protection history events are retained in Windows 11.
If you find any error above or have something to add, please use the comment form below.
