Microsoft Defender

Where Microsoft Defender keeps its logs

Microsoft Defender logs to Event Viewer > Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational on Windows. 1 other Windows log location is recorded below.

Microsoft Defender logs to /Library/Logs/Microsoft/Defender/ on macOS.

Microsoft Defender logs to /var/log/microsoft/mdatp/ on Linux.

Paths are printed exactly as Microsoft Defender writes them. Environment variables like %LOCALAPPDATA% and $XDG_STATE_HOME are never expanded, so a path can be pasted straight into a shell. Where a path differs between installer types or shipping flavours, each one is racked as its own card below - why that happens.

Finding your way around Windows, macOS and Linux.