How to configure quarantine files removal on Windows Defender Antivirus

On Windows 10, when Windows Defender Antivirus can't fully determine if a suspicious file is infected, usually, it moves it to the Quarantine folder. This is a special location designed to isolate threats and so that they tin't harm your computer, or then you lot can restore simulated positives as necessary.

The only caveat is that these suspicious items will stay forever in the Quarantine folder. However, if yous don't want to proceed these items for a long time, or y'all want to forbid attackers potentially restoring quarantined threats back to your device (as nosotros've recently seen with the AVGater exploit that affected several AV software), information technology's possible to configure the Windows 10 antivirus to remove quarantined items later on certain number of days automatically.

In this Windows 10 guide, we'll walk yous through the steps to configure Windows Defender Antivirus to remove quarantine items after a certain number of days you specify.

How to manage quarantine items removal using Group Policy
How to manage quarantine items removal using Registry

How to manage quarantine items removal using Grouping Policy

If you're running Windows 10 Pro or Enterprise, yous tin can use the Local Group Policy Editor to configure the removal of threats in the Quarantine binder subsequently a specified number of days.

Of import: Use these instructions carefully and make sure to allow enough time to inquiry the suspicious to find out if it's, in fact, a threat, and to restore the items if it ends up being a false positive.

Utilise the Windows key + R keyboard shortcut to open the Run command.
Type gpedit.msc and click OK to open the Local Group Policy Editor.
Scan the following path:

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > Quarantine
On the right side, double-click the Configure removal of items from Quarantine folder policy.
Select the Enabled option.
Under "Options," select the number of days (e.thou., fourteen) that y'all want to continue infected items in quarantine.
Click Apply.
Click OK.

Once you've completed the steps, Windows Defender Antivirus will delete quarantine items subsequently the number of days you specified, or immediately if y'all used 0 (zero) in the "Options" field.

If you change your listen, you tin always revert the changes by using the aforementioned steps, but on stride No. 5, make sure to select the Not Configured pick.

How to manage quarantine items removal using Registry

If y'all're running Windows 10 Dwelling house, you won't take access to the Local Group Policy Editor, simply it'south possible to change the quarantine settings for the Windows Defender Antivirus by editing the Registry.

Warning: This is a friendly reminder that editing the Registry is risky, and it can cause irreversible damage to your installation if y'all don't do it correctly. It'due south recommended to make a full backup of your PC before proceeding.

Apply the Windows cardinal + R keyboard shortcut to open the Run command.
Blazon regedit, and click OK to open the Registry.
Browse the following path:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender

Quick Tip: On the Windows 10 Creators Update and later, you can copy and paste the path into the new Registry'south accost bar to quickly jump to the fundamental destination.
Correct-click on the Windows Defender (folder) key, select New, and click on Key.
Name the cardinal Quarantine and press Enter.
Right-click on the Quarantine (binder) key, select New, and click on DWORD (32-chip) Value.
Proper name the key PurgeItemsAfterDelay and press Enter.
Double-click the newly created key, and select Decimal.
In the "Value data" field, specify the number of days that the antivirus should proceed infected items earlier removing them.
Click OK.

After completing the steps, quarantine items will exist purged from your computer later on the number of days yous specified in the Registry.

At whatever time, y'all can remove the settings by post-obit the same instructions, but on footstep No. five, correct-click the Quarantine (binder) key and click Delete to remove the entries.