Safe to Delete

Windows Defender Scans & Definitions Cache

Quick Answer: The Windows Defender Scans folder holds virus scan history and security definition updates. It is safe to clean out when it accumulates gigabytes of leftover cache.

Bottom Line: It is safe to clean out Windows Defender scan logs and definition update caches. Deleting these files does not disable your antivirus protection—it simply removes old scan history and obsolete virus definition downloads.


What is the Windows Defender Scans Folder?

Located at C:\ProgramData\Microsoft\Windows Defender\Scans, this system folder stores:

  • Scan History & Detection Logs: Information about past quick/full system antivirus scans.
  • Network & File History: Logs of scanned downloaded files.
  • Definition Update Cache: Staged files from past Microsoft Security Intelligence definition updates (C:\ProgramData\Microsoft\Windows Defender\Definition Updates).

In some Windows releases, a known bug caused Microsoft Defender to create millions of tiny files inside the Scans\History\Store subfolder, filling up SSDs with 5 GB to 10 GB+ of unnecessary log files.


Can You Delete Defender Scans Cache?

✅ Yes, it is completely safe to clean.

  • Antivirus status remains active: Real-time protection, firewall, and active virus definitions stay 100% active.
  • Frees space: Removing old scan history logs releases thousands of small files that slow down drive indexing.

How to Safely Clean Up Windows Defender Cache

Because C:\ProgramData\Microsoft\Windows Defender is protected by Windows Tamper Protection, you must follow the proper steps below.

Method 1: Clear Defender Scan History via Windows Security

  1. Open Windows Security from the Start Menu or system tray.
  2. Click Virus & threat protection > Protection history.
  3. Clear old alert history entries.

Method 2: Manual Clean Up via Command Prompt (Admin)

If thousands of files remain in the Scans folder:

  1. Open Start, search cmd, right-click Command Prompt, and select Run as administrator.
  2. Run the following command to clear obsolete Defender definition update cache:
    "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
    "C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate
  3. This purges old accumulated signature files and instantly downloads the latest single active definition file.

  • Learn about deleting [Antivirus Quarantine Folders].
  • How to safely clean up [Windows Temp Files].
  • Check if you can shrink WinSxS Store.

Discussion

Loading authentication...

Related in antivirus

BleachBit vs Windows Storage Sense: Which Cleaner Is Best & Safest?

A head-to-head comparison of open-source BleachBit vs native Windows Storage Sense for safe disk cleanup and privacy shredding.

Safe to Delete

ClamAV Open-Source Antivirus Virus Definition Databases (/var/lib/clamav)

ClamAV stores daily virus definitions (main.cvd, daily.cvd) in /var/lib/clamav. Learn how freshclam updates ClamAV databases.

Safe to Delete

Is CCleaner Safe to Use in 2026? (Registry Risks & Built-in Alternatives)

A detailed security review answering if CCleaner is safe for Windows 11 registry cleaning, its malware history, and built-in safe alternatives.

Use Caution
Back to all files