{"id":45734,"date":"2023-05-13T16:35:43","date_gmt":"2023-05-13T11:05:43","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=45734"},"modified":"2023-06-27T18:39:58","modified_gmt":"2023-06-27T13:09:58","slug":"defender-accidentally-allowed-a-threat","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/defender-accidentally-allowed-a-threat\/","title":{"rendered":"Accidentally Allowed a Threat in Windows Defender. What to do now?"},"content":{"rendered":"

When Microsoft Defender Antivirus finds a virus, it asks you what action to take on the threat. The options are “Remove”, “Quarantine”, and “Allow on device”.<\/p>\n

You may wonder:<\/p>\n

    \n
  1. What happens if you’ve accidentally clicked “Allow” instead of “Remove”?<\/li>\n
  2. What happens to the “allowed” threat? Will Microsoft Defender Antivirus redetect the item during the next scan?<\/li>\n<\/ol>\n


    \nIf you accidentally allow a threat, Microsoft Defender stores the setting (Threat ID) in the registry. The file won’t<\/strong> be flagged when you run it in the future or during a system scan. This poses a big security risk.<\/p>\n

    You may also see the note “This threat or app has been allowed and will not be remediated in the future” in the Windows Security user interface.<\/p>\n

    Resolution<\/h2>\n

    To resolve the issue, please undo your choice by opening Windows Security \u2192 Virus and Threat protection \u2192 “Allowed Threats.”<\/p>\n

    In the “Allowed threats” page, click the “Don’t allow<\/strong>” button for the program(s) you accidentally allowed to run.<\/p>\n

    \"Defender<\/p>\n

    Do this for each threat for which you inadvertently the “Allow” button.<\/p>\n

    And then remediate the threat by clicking “Remove” or “Quarantine” and click “Start actions”.<\/p>\n

    Using PowerShell to reset the Allowed threat listing<\/h3>\n

    To bulk delete the allowed threats listing, use PowerShell (admin).<\/p>\n

    In PowerShell admin, run the following commands:<\/p>\n

    $ThreatIds = (Get-MpPreference).ThreatIDDefaultAction_Ids\r\n\r\nForeach ($ThreatId in $ThreatIds) { Remove-MpPreference -ThreatIDDefaultAction_Ids $ThreatId -Verbose }<\/pre>\n
    That’s it. It clears the “Allowed threats” listing automatically.<\/p>\n","protected":false},"excerpt":{"rendered":"
    When Microsoft Defender Antivirus finds a virus, it asks you what action to take on the threat. The options are “Remove”, “Quarantine”, and “Allow on device”. You may wonder: What happens if you’ve accidentally clicked “Allow” instead of “Remove”? What happens to the “allowed” threat? Will Microsoft Defender Antivirus redetect the item during the next … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[8,869],"tags":[396,661],"class_list":["post-45734","post","type-post","status-publish","format-standard","hentry","category-windows-10","category-windows-11","tag-powershell","tag-windows-defender"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":5125,"url":"https:\/\/www.winhelponline.com\/blog\/windows-defender-disabled-real-time-protection-virus\/","url_meta":{"origin":45734,"position":0},"title":"Microsoft Defender: “Managed by your administrator” or “Your IT administrator has limited access”","author":"Ramesh","date":"January 23, 2017","format":false,"excerpt":"In the aftermath of a malware attack, the Windows Defender Security settings page may show the message Some settings are managed by your organization\u00a0or This setting is managed by your administrator. The real-time protection and cloud-based protection options may remain disabled or grayed out. Here is what the Windows Defender\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"Microsoft Defender Antivirus group policy settings","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/windows-defender-gpedit-ui.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/windows-defender-gpedit-ui.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/windows-defender-gpedit-ui.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/windows-defender-gpedit-ui.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":59671,"url":"https:\/\/www.winhelponline.com\/blog\/reset-exclusions-windows-defender\/","url_meta":{"origin":45734,"position":1},"title":"How to Bulk Reset Exclusions in Windows Defender","author":"Ramesh","date":"July 24, 2023","format":false,"excerpt":"In the aftermath of a malware attack, you often end up with unwanted exclusion entries in Microsoft Defender Antivirus. Exclusions may exist for a folder, file, file type, or process. These exclusions can be cleared by opening the Virus and Threat Protection page in Windows Security. Select each entry and\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"powershell reset exclusions","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/07\/defender-exclusions-clear-powershell.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/07\/defender-exclusions-clear-powershell.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/07\/defender-exclusions-clear-powershell.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/07\/defender-exclusions-clear-powershell.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":17887,"url":"https:\/\/www.winhelponline.com\/blog\/windows-defender-identifies-same-threat-repeatedly\/","url_meta":{"origin":45734,"position":2},"title":"Windows Defender Shows the Same Threat Repeatedly. How to Clear the Protection History","author":"Ramesh","date":"August 14, 2020","format":false,"excerpt":"On some Windows 10 and 11 computers, Microsoft Defender Antivirus may repeatedly warn about the same threat, although you've taken the necessary action (remediated) on that threat. When you click \"Start actions\" after choosing \"Remove\", nothing happens. Windows Defender would keep showing that non-existent threat. Cause This is caused by\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"detectionhistory folder contents","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/08\/defender-detection-history-delete.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/08\/defender-detection-history-delete.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/08\/defender-detection-history-delete.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/08\/defender-detection-history-delete.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":3689,"url":"https:\/\/www.winhelponline.com\/blog\/start-windows-defender-offline-scan\/","url_meta":{"origin":45734,"position":3},"title":"How to Start Microsoft Defender Offline Scan in Windows 10\/11","author":"Ramesh","date":"August 4, 2016","format":false,"excerpt":"Malware is more complex today than it was many years ago. It operates at the filter driver, service, or rootkit level, and eliminating it is tough. Sometimes, you need to boot to the Windows RE environment and then delete the core malware files and services added to your Windows installation.\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"Microsoft Defender Offline scan - Virus and threat protection - Windows Security","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/08\/wdo-scan-4.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/08\/wdo-scan-4.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/08\/wdo-scan-4.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":18890,"url":"https:\/\/www.winhelponline.com\/blog\/windows-defender-service-missing-security-page-empty\/","url_meta":{"origin":45734,"position":4},"title":"Windows Defender Service Missing; Security at a glance page is Empty","author":"Ramesh","date":"September 26, 2020","format":false,"excerpt":"In the aftermath of malware infection, when you open the Services MMC on a Windows 10 or 11 computer, you may find that the Windows Defender (\"Microsoft Defender Antivirus Service\") service is missing from the Services MMC. The Windows Security settings \"Security at a glance\" page may show up empty\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"advancedrun start regedit.exe","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/09\/advancedrun-start-regedit.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/09\/advancedrun-start-regedit.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/09\/advancedrun-start-regedit.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":5966,"url":"https:\/\/www.winhelponline.com\/blog\/windows-defender-disabled-by-malwarebytes-antivirus-protection\/","url_meta":{"origin":45734,"position":5},"title":"Fix: Malwarebytes Disables Defender or 3rd Party Anti-Virus","author":"Ramesh","date":"November 22, 2017","format":false,"excerpt":"After installing Malwarebytes Premium 14-day trial or licensed product, your anti-virus software (e.g., Microsoft Defender Antivirus) may get disabled automatically. In this scenario, when you attempt to start the Microsoft Defender Antivirus Service\u00a0(WinDefend) via the Services console, it shows the following error, and the service wouldn't start. The Windows Defender\u2026","rel":"","context":"In "Utilities"","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"malwarebytes security center register","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/11\/mbam-register-wsc-off.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/11\/mbam-register-wsc-off.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/11\/mbam-register-wsc-off.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/11\/mbam-register-wsc-off.png?resize=700%2C400&ssl=1 2x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/45734","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/comments?post=45734"}],"version-history":[{"count":0,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/45734\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/media?parent=45734"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/categories?post=45734"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/tags?post=45734"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}