Microsoft Defender scan history before opening files from unfamiliar downloads

Checking Defender Scan History Before Opening Unknown Files

When you download a file from an unfamiliar source, the first useful step is to see what Microsoft Defender already did with it. Defender automatically scans most downloads when they arrive, so the scan history can tell you whether the file was flagged, passed a quick scan, or is still waiting for a full check. Opening the file before checking this history means you might miss a warning that Defender already raised. To check the history, open Windows Security from the Start menu, then go to the Virus & threat protection section.

Look for the Protection history link. Recent scans appear on this page, including any threats detected, actions taken, and files that were allowed after a scan. A warning for the downloaded file means you should not open it until you read the recommended action or remove the file. No entry for that file may mean it passed a quick scan or was not scanned at all, which means you need to run a manual scan before opening it.

Understanding Threat Labels and Actions in the History

Each entry in the protection history includes a threat label, severity level, and the action Defender took. Labels such as Trojan, Worm, or Severe mean the file was flagged as dangerous. Low or Informational labels may indicate a potentially unwanted app or a file that was allowed by policy. The action taken can be Quarantined, Removed, Allowed, or No action. Defender quarantining or removing the file makes it safer to delete the download and not try to recover it. An action showing Allowed or No action requires checking whether the file was allowed because you clicked a prompt or because Defender identified it as safe.

Allowed entries with a Low threat level still carry some risk, especially from unfamiliar sources. Do not rely only on the label; read the details link inside each entry to see the file name, detection time, and the exact threat name. A file name matching your download with a Severe threat level means you should not open it. A file name that does not appear at all means you should proceed to a manual scan before opening.

Using the Protection History Table for Quick Decisions

Review the protection history for the threat label, action taken, and file name match to decide your next action before opening the file. Keep this guide visible while reviewing your download history so you can decide quickly without re-reading the full explanation each time.

A Severe label or a quarantined action means you should not attempt to restore the file. An Allowed entry with a Low label means you should open the file only after running a full scan. No entry existing means the file was not scanned, so a manual scan is the safest next step before any interaction.

Running a Manual Scan When History Is Not Enough

When the protection history shows no entry for your download, or when the entry is unclear, run a manual scan using Microsoft Defender. Right-click the downloaded file in File Explorer and select Scan with Microsoft Defender. A full scan of that specific file is triggered, not just a quick check. The scan result will appear in a new window, and the result will also be added to the protection history for future reference. A threat found by the manual scan means you should delete the file immediately and empty the Recycle Bin. No threats shown by the scan means you can open the file, but stay cautious.

Unfamiliar downloads can sometimes contain threats that newer definitions catch later. Keep Defender updates turned on and consider scanning the file again after a few days if you still have doubts. Reducing the chance of opening a file that was missed during the initial automatic scan is the goal of this habit.