List Windows Defender Quarantined Files (MpCmdRun)
Show every file Defender has quarantined from the command line, without opening the Security app.
01Command
$ & "$env:ProgramFiles\Windows Defender\MpCmdRun.exe" -Restore -ListAll02What it does
When Defender detects a threat it moves the file into quarantine rather than deleting it, and this MpCmdRun switch lists everything currently held there. Each entry shows the original path and threat name so you can judge whether a detection was a false positive. The same tool can put items back with -Restore -All, or you can review them in the Windows Security app's protection history.
03Risk
04Undo
✓No undo needed — this command does not change persistent state.
05Sources
- Configure and manage Microsoft Defender Antivirus with the mpcmdrun.exe command-line toolEvidence: Documents MpCmdRun.exe -Restore -ListAll, which enumerates all items currently in Defender quarantine (with -Restore -All to put them back).
Last verified: 2026-09-18 · Category: Security & Privacy
06Related solutions
Built-in Windows command to compute MD5, SHA1 or SHA-256 hashes of any file.
Understand PowerShell's execution policy scopes and set the one that lets you run your own local scripts without gutting the security model.
One command that shows OS version, install date, boot time, memory, network adapters and installed hotfixes.