Microsoft-Windows-Windows Defender/OperationalMicrosoft Defender Antivirus

1117 · The antimalware platform performed an action to protect your system

Microsoft Defender Antivirus took an action (such as quarantine or remove) on detected software. Records the action, its status and any error.

01Fields in the event

Name
ID
Severity
Category
Path
Detection Origin
Detection Type
Detection Source
User
Process Name
Action
Action Status
Error Code
Error Description
Signature Version
Engine Version

02How to use it

Determine whether the threat was actually remediated: an Allow, No action or None action leaves it in place. Quarantined items may be recoverable for analysis.

03Caveats

A successful action does not mean the threat had not already run. Field names are the labels listed by Microsoft.

05Sources

Microsoft Learn — Microsoft Defender Antivirus event IDs and error codes checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.