How to Clean Microsoft Defender Protection & Scan History Cache
Location & Quick Verdict
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service
Microsoft Defender Antivirus logs historical scan results and quarantined detection metadata inside ProgramData\Microsoft\Windows Defender.
How Windows Manages Microsoft Defender Protection & Scan History Cache on NTFS & NVMe Drives
Windows 10 and Windows 11 maintain hidden system directories and root-level allocation files at C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service to handle shell thumbnail databases, prefetcher launch traces, hibernation power states, and user-profile scratch storage. Because many of these paths are marked with +H (Hidden) or +S (System) attributes or guarded by SYSTEM ACL permissions, standard folder size scans often miss them entirely.
Over time, orphaned temporary files, stale Explorer DataCache_* buckets, and uncompacted virtual storage allocations inside C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service lock up 0.8 GB – 4.5 GB of primary C: drive space. Cleaning Microsoft Defender Protection & Scan History Cache using the proper administrative method restores drive headroom safely.
# Inspect current disk footprint of Microsoft Defender Protection & Scan History Cache (Read-Only)
$target = "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service"
Get-ChildItem -Path $target -Recurse -Force -ErrorAction SilentlyContinue |
Measure-Object -Property Length -Sum |
Select-Object Count, @{Name="SizeGB";Expression={[math]::Round($_.Sum / 1GB, 2)}}
Manual Cleaning Instructions
- 1 Open Windows Security > Virus & threat protection > Protection history.
- 2 Or use SWEEPR Cleaner to clear expired scan log caches older than 30 days.
Note: If Windows alerts that a file is in use or locked by a background process, close the associated task in Task Manager before deleting, or use SWEEPR Cleaner to release locked handles safely.
Sub-Folders & Cache Locations Breakdown for Microsoft Defender Protection & Scan History Cache
Modern Windows applications and system services split their disk footprint across multiple sub-directories (`Cache_Data`, `Service Worker\CacheStorage`, `Code Cache`, `GPUCache`, and `Crashpad\reports`). Review which sub-folders inside Microsoft Defender Protection & Scan History Cache are safe to purge and which files remain protected:
| Sub-Folder / Cache Location | Storage Role | Typical Footprint | Deletion Safety |
|---|---|---|---|
| C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service | Primary System Scratch, Thumbnail/Icon DB or Virtual Allocation | 0.8 GB – 4.5 GB | 🟢 100% Safe (Unlocked Files) |
| %LocalAppData%\Temp & C:\Windows\Temp | Orphaned Installer Extraction & Session Scratch Files | 1.5 GB – 18.0 GB | 🟢 100% Safe |
| %LocalAppData%\Microsoft\Windows\Explorer (thumbcache_*.db) | Cached File Explorer Image & Video Thumbnail Databases | 250 MB – 3.0 GB | 🟢 100% Safe (Rebuilds Automatically) |
| User Documents, Desktop & Registry Hives | Personal Files, Boot Configuration & System Certificates | Protected | 🔒 Protected — Never Touched |
Frequently Asked Questions
Is it safe to delete Microsoft Defender Protection & Scan History Cache?
Yes, 100% safe. Clears old detection history logs and reclaims disk space while keeping real-time antivirus protection active.
How much storage space will cleaning Microsoft Defender Protection & Scan History Cache free up?
Users typically reclaim 0.8 GB – 4.5 GB on Windows 10 and Windows 11 systems depending on update frequency and active cache retention in C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service.
Why does Windows say some files in Microsoft Defender Protection & Scan History Cache are "In Use" when I try to delete them?
Active background processes (such as explorer.exe, svchost.exe, or running desktop apps) hold open file handles to current session scratch files. Skipping locked files—or letting SWEEPR Cleaner clean unlocked items automatically—is normal and completely safe.
Where is Microsoft Defender Protection & Scan History Cache located on Windows 10 and Windows 11?
It is stored at C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service. You can paste that path directly into the Windows Run dialog (Win + R) or File Explorer address bar to inspect it.
Manual File Explorer vs. 1-Click SWEEPR Cleanup
| Feature | Manual Deletion | SWEEPR Cleaner |
|---|---|---|
| Locked File Handling | Fails on locked processes | Safe background release |
| Accidental Deletion Risk | Moderate (easy to delete wrong folder) | Zero (strict rules & hashes) |
| Safety Undo Rollback | None (Shift+Del is permanent) | 7-Day Automatic Rollback |
| Time Required | 10–20 minutes per app | < 60 seconds across 40+ areas |
Related Windows Cleanup Guides & Hidden Space Hogs
Clean Microsoft Defender Protection & Scan History Cache Automatically
SWEEPR Cleaner safely clears Microsoft Defender Protection & Scan History Cache along with 40+ other hidden app folders and leftover files in one click—covering up to 5 devices (Windows, Mac, Android & iOS) with a 7-day undo safety net.