Defender Event ID 1117: The antimalware platform performed an action to protect your system
Written when Defender acts on a detection: quarantine, removal or block.
- Log
- Microsoft-Windows-Windows Defender/Operational
- Category
- Detection
Why it matters
- If the action failed, or the same threat keeps returning, the source is still active.
What to check
Check Action, Error Code and Path, and match it to the 1116 detection.
How to turn it on
Logged by default when Defender Antivirus is active.