How to Monitor Microsoft Defender Antivirus Using Event Viewer Logs

Microsoft Defender Antivirus is Microsoft’s built-in security solution designed to protect Windows devices from viruses, malware, ransomware, potentially unwanted applications (PUAs), and other cyber threats.

One of the most valuable troubleshooting and monitoring tools available to administrators and security professionals is the Microsoft Defender Antivirus Operational Log, which records security events, scans, updates, threat detections, configuration changes, and service health information.

This article explains how to access Microsoft Defender Antivirus events and provides a comprehensive overview of the most important Event IDs.

How to View Microsoft Defender Antivirus Events

Microsoft Defender Antivirus logs its operational events in the Windows Event Viewer.

Steps to Access Defender Events

1. Press Windows Key + R.
2. Type eventvwr.msc and click OK.
3. Navigate to Applications and Services Logs -> Microsoft -> Windows -> Windows Defender -> Operational
4. Browse the event list to locate specific Defender events.
5. Use Find or Filter Current Log from the Actions pane to quickly locate relevant Event IDs.
6. Select an event to view detailed information in the General and Details tabs.

These logs help administrators investigate malware detections, verify antivirus updates, monitor scan activity, and troubleshoot Defender-related issues.

As an example, a test executable was used to verify Microsoft Defender Antivirus event generation and logging behavior. The test successfully triggered Windows Defender Operational Event ID 2050, confirming that Microsoft Defender Antivirus correctly processed and recorded the file activity.

The generated event captured key forensic details including the file path, SHA256 hash, Defender product version, device name, process and thread identifiers, activity correlation ID, and event timestamp.

This validation demonstrates that Defender’s detection and telemetry pipeline is functioning as expected, ensuring that relevant security events are available for downstream monitoring, threat hunting, incident investigation, and SIEM/SOC integrations.

The successful generation of Event ID 2050 provides confidence that endpoint security events can be reliably collected and analyzed for operational security monitoring.

Conclusion

Microsoft Defender Antivirus Event Viewer logs provide critical visibility into scans, malware detections, remediation actions, updates, service health, and configuration changes. By understanding key Event IDs, administrators can quickly troubleshoot security issues, verify protection status, investigate threats, and maintain a secure Windows environment.

Among all Defender events, administrators should pay particular attention to:

• 1006 – Malware detected
• 1117 – Malware action taken
• 2000 – Security intelligence updated successfully
• 2001 – Security intelligence update failed
• 3002 – Real-time protection failure
• 5001 – Real-time protection disabled
• 5007 – Configuration changed
• 5013 – Tamper Protection blocked a change

Regular monitoring of these events can significantly enhance an organization’s security posture and ensure Microsoft Defender Antivirus continues to protect endpoints effectively.