Why Quarantine Restore Fails for a Repeatedly Detected File on Windows 11

You have a file that Windows Security repeatedly detects as a threat. You try to restore it from quarantine, but the restore fails or the file is immediately re-detected. This happens because Windows Security’s real-time protection scans the file again as soon as it leaves quarantine. This article explains the root cause of this loop and provides the exact steps to safely restore a file without triggering re-detection.

Why Windows 11 Repeatedly Detects the Same File After Restore

Windows Security uses real-time protection to scan any file that is created, modified, or accessed on your system. When you restore a file from quarantine, Windows Security treats that action as a new file access event. The real-time protection engine immediately scans the restored file. If the file’s signature still matches a known threat definition, Windows Security quarantines it again.

This creates a loop: restore triggers scan, scan detects threat, file is re-quarantined. The file never stays on disk long enough for you to use it. The root cause is not a bug. It is the intended behavior of real-time protection. Windows Security does not have a built-in exception for files you manually restore from quarantine.

Another factor is the type of detection. If the file is flagged as a trojan, ransomware, or a high-severity threat, Windows Security uses a more aggressive scanning policy. These files are re-scanned immediately upon restore. Lower-severity detections such as Potentially Unwanted Applications may also trigger a re-scan, though the behavior is the same.

Steps to Restore a File That Is Repeatedly Detected by Windows Security

To break the detection loop, you must add an exclusion for the file before you restore it. The exclusion tells Windows Security to skip real-time scanning for that specific file, folder, or process. Follow these steps in order.

Step 1: Locate the Quarantined File in Protection History

1. Open Windows Security
   Click the Start button, type Windows Security, and press Enter.
2. Go to Virus & threat protection
   In the left sidebar, click Virus & threat protection.
3. Click Protection history
   Under the Current threats section, click Protection history. A list of recent detections appears.
4. Find the repeatedly detected file
   Look for the file that keeps appearing. Click the entry to expand it. Note the full file path, file name, and the threat name. You will need this information to add the exclusion.

Step 2: Add an Exclusion for the File

1. Open Manage settings
   In Windows Security, click Virus & threat protection. Under Virus & threat protection settings, click Manage settings.
2. Scroll to Exclusions
   Scroll down to the Exclusions section. Click Add or remove exclusions. If prompted by User Account Control, click Yes.
3. Add an exclusion for the file
   Click Add an exclusion, then choose File from the dropdown menu. Browse to the exact file path you noted in Protection history. Select the file and click Open. The file is now added to the exclusion list.
4. Verify the exclusion is active
   You should see the file path listed under Exclusions. If you prefer to exclude the entire folder, choose Folder instead of File and select the parent folder.

Step 3: Restore the File from Quarantine

1. Open Protection history again
   Go back to Virus & threat protection > Protection history.
2. Select the quarantined item
   Click the entry for the file you want to restore. Click the Actions dropdown and select Restore.
3. Confirm the restore
   A confirmation dialog appears. Click Yes to restore the file to its original location. Because the exclusion is in place, real-time protection does not scan the file again. The file remains on disk.

Step 4: Verify the File Is Accessible

1. Open File Explorer
   Press Windows key + E to open File Explorer.
2. Navigate to the file location
   Go to the folder where the file was restored. Open the file to confirm it is no longer blocked. If you still see a security warning, you may need to unblock the file manually.
3. Unblock the file if needed
   Right-click the file, select Properties. On the General tab, if you see a Security message at the bottom, check Unblock and click Apply > OK.

If the Restore Still Fails After Adding an Exclusion

Windows Security Shows an Error When Restoring

If you see an error message such as “Something went wrong” or “The operation failed,” the quarantine database may be corrupted. Open Command Prompt as administrator and run the following command to reset the Windows Security service:

net stop WinDefend && net start WinDefend

Then try the restore again. If the error persists, restart your computer and repeat the restore steps.

File Is Not Listed in Protection History

If the file does not appear in Protection history, it may have been removed by a cleanup action. Check the quarantined items directly. Open Windows Security, go to Virus & threat protection > Protection history, then click See full history. If the file is still missing, run a full scan to trigger a new detection, then restore it using the exclusion method above.

Exclusion Is Ignored by Windows Security

In rare cases, an exclusion may not take effect if the file is detected by Microsoft Defender for Endpoint or another security product. If you are using a third-party antivirus, disable it temporarily and add the exclusion again. For business devices managed by IT, group policy may override local exclusions. Contact your IT administrator to add the exclusion through Intune or Group Policy.

Quarantine Restore vs Exclusion: Restore Behavior Comparison

Item	Restore Without Exclusion	Restore With Exclusion
Real-time scan after restore	Immediate scan triggers re-detection	Scan skipped for the excluded file
File remains on disk	No, re-quarantined immediately	Yes, file stays accessible
User action required	No additional steps	Must add exclusion before restore
Risk of infection	Low, file is removed	Higher, exclusion bypasses protection

Restoring a file with an exclusion is a deliberate action that should only be done when you are certain the file is safe. If you are unsure, submit the file to Microsoft Security Intelligence for analysis before restoring it.

You can now restore a repeatedly detected file on Windows 11 by adding an exclusion before the restore action. This method stops the detection loop and keeps the file on your system. To reduce future detections, consider moving the file to a folder that is excluded from real-time scanning. The Add an exclusion > Folder option in Windows Security settings is the most efficient way to exclude multiple files at once.