Windows defender operational event log not updating

for some reason, the windows defender event log, as visible through the Windows Event Viewer application has stopped receiving new events. Previously, Windows Defender Antivirus would log events under Applications and Services Logs->Microsoft->Windows->Windows Defender/Operational. There, I could see when a scan started, completed, found/responded to malware, and other events.

However, starting a little over a month ago, the log in Event Viewer was no longer listed under its previous location and was instead directly inside the Application and Services Logs folder with the name "Microsoft-Windows-Windows Defender/Operational". In addition to this location change, no actions taken by Windows Defender are being added to this file.

The following is a screenshot of my Event Viewer with the log in changed location. In the screenshot, it is also visible that the last event recorded there was from over a month ago.

Image

The following is the location in Application and Services Logs->Microsoft->Windows where I would previously have found a folder named "Windows Defender"

Image

One thing that I considered is that there may have been some Windows Defender update that changed how it handled logging, however, this change in behavior has only happened on a couple of laptops I've checked, while others still operate as before. All devices I checked are running Windows 10. This is problematic for me since an application I am working on listens and responds to this event log, so while other machines are still functioning correctly, the app on my laptop and others with a similar issues can no longer respond to antivirus events. Does anyone know why my Windows Defender has stopped updating this log, and if there is a way to fix that?

This is not a normal behavior, did you download or install any program before this problem started?

What build of Windows 10 are you using?

Try open start and search for feedback and open Feedback Hub app and report this issue.

1 person found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Thanks for the response. My laptop is currently running Version 20H2 (OS Build 19042.1237), but I think I've updated a couple times since this issue started. I do not recall installing any programs that I would not trust or that would impact Windows Defender. Looking further into it, I checked my registry editor and compared a couple laptops that were having this issue to a machine that was not. One thing I noticed was that there was an additional folder "Microsoft-Windows-Windows Defender/Operational" under SYSTEM\CurrentControlSet\EventLog. This folder wasn't present on the normal machine.

(note: the AntivirusTester subfolder is only present on one of the problematic machines. I think that was from when I was attempting to mock Windows Defender events through PowerShell)

Image

I actually just deleted that folder on one of the problematic laptops, and, after restarting, the Windows Defender logs seem to be back in the correct location and are receiving updates again! I'm not sure how these folders got into the registry in the first place, but they seem to have been changing how the event viewer was handling Windows Defender antivirus events.

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

You mentioned about the PowerShell script to mock the Windows Defender event, would you mind explain more about it. I believe this might have been created with that PowerShell script.

1 person found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

 
 

Question Info


Last updated April 19, 2025 Views 1,592 Applies to: