Defender Event ID 1116: The antimalware platform detected malware or other potentially unwanted software
Written when Microsoft Defender Antivirus detects malware or potentially unwanted software.
- Log
- Microsoft-Windows-Windows Defender/Operational
- Category
- Detection
Why it matters
- A detection does not mean it was removed; check the 1117 that follows for the action taken.
What to check
Check Threat Name, Severity, Path, Detection User and Process Name.
How to turn it on
Logged by default when Defender Antivirus is active.