Defender keeps a gigabyte of definitions and a history nobody clears
The security software built into Windows has its own folders. What is in them, what is safe, and the one that genuinely grows.
Under C:\ProgramData\Microsoft\Windows Defender is a folder that most people never see and that is a reliable gigabyte on any Windows machine. It is not a problem, and it is worth being able to recognise so that it stops being a mystery.
What is in there
| Part | What it is | Clear it? |
|---|---|---|
| Definition updates | Signatures, updated several times a day | No, it is the protection |
| Platform versions | The engine, one folder per version | Old ones go on their own |
| Scans\History | Records of past detections | Yes, through Settings |
| Quarantine | Files it isolated | Only through Defender itself |
| Support logs | Diagnostic output | Yes, and usually small |
The one that actually grows
Scan history. Every detection and every scan result is recorded and nothing prunes it aggressively. On a machine that has been running for years with regular scans, this is the part worth clearing, and Windows exposes it properly:
- Windows Security, Virus and threat protection.
- Protection history.
- Filter and clear entries you no longer need.
Quarantine is not a cache
Files Defender isolated are still on the disk, deliberately, so you can restore one it was wrong about. They are removed automatically after a retention period, and they can be removed sooner from the same Protection history screen. Deleting them from the folder by hand is the one action here that can go badly: the quarantine store is encrypted and the metadata has to match.
Old platform versions
Defender updates its engine by installing a new versioned folder beside the old one, and removes the previous one on a schedule. A machine that has been off for a long stretch can have two or three. They tidy themselves and are not worth chasing.
Third party antivirus on the same machine
If you have installed another security product, Defender steps back but its folders remain, and the other product now has folders of its own in ProgramData that are frequently larger. That is worth checking on the same pass, and it is the same pattern as anything else that leaves folders behind.
Common questions
Why is the Windows Defender folder so large?
Mostly definition updates and the engine, which together are around a gigabyte on a current machine. Scan history is the part that grows over time and is the one worth clearing.
Can I delete Windows Defender definitions?
No. They are the protection itself and Defender redownloads them immediately. If the folder is unusually large, it is scan history rather than definitions, and that is cleared from Protection history.
How do I clear Defender's protection history?
Windows Security, Virus and threat protection, Protection history. Entries can be filtered and cleared there, which is the supported route and keeps the quarantine store consistent.
Is it safe to delete quarantined files?
Through Windows Security, yes. They are removed automatically after a retention period anyway. Deleting them from the folder by hand is not safe, because the store is encrypted and its metadata has to match.