Defender’s Action center history supports undoing an eligible quarantine action for one file. The interface can also apply an undo to additional instances of that file. An unavailable Undo button indicates that the selected action cannot be reversed there; actions performed through live response cannot be undone. Microsoft Learn.
\nMicrosoft’s command-line CustomEnterpriseBlock restoration example is broader: its warning says it restores all custom-blocked files quarantined on that device during the preceding thirty days. The source also warns that a file quarantined as a potential network threat might not be recoverable. Microsoft Learn.
\nThis brief concerns Windows Defender for Endpoint false-positive remediation and quarantined files. Establish that the file is safe before choosing a restoration method. Restoring an artifact and changing future protection policy are separate decisions.
\nDSE recommends starting with the completed action’s details and an explicit list of intended file instances and devices. Review any expanded instance selection before executing an undo. Do not translate one approved release into approval for every custom-blocked artifact from the same device. If restoration is unavailable, escalate with the original action and location evidence rather than repeatedly trying broader commands.
\nCheck the action outcome and the intended file on each approved device. Compare the actual restoration scope with the approved list and investigate unexpected releases. Preserve the safety determination and action record together. Review any requested exclusion separately, so restoring a wrongly quarantined file does not silently become a permanent reduction in inspection.
\nMicrosoft Learn: Address Defender for Endpoint false positives and negatives.
", "content_text": "Source facts\nDefender’s Action center history supports undoing an eligible quarantine action for one file. The interface can also apply an undo to additional instances of that file. An unavailable Undo button indicates that the selected action cannot be reversed there; actions performed through live response cannot be undone. Microsoft Learn.\nMicrosoft’s command-line CustomEnterpriseBlock restoration example is broader: its warning says it restores all custom-blocked files quarantined on that device during the preceding thirty days. The source also warns that a file quarantined as a potential network threat might not be recoverable. Microsoft Learn.\nApplicability\nThis brief concerns Windows Defender for Endpoint false-positive remediation and quarantined files. Establish that the file is safe before choosing a restoration method. Restoring an artifact and changing future protection policy are separate decisions.\nDSE recommendation\nDSE recommends starting with the completed action’s details and an explicit list of intended file instances and devices. Review any expanded instance selection before executing an undo. Do not translate one approved release into approval for every custom-blocked artifact from the same device. If restoration is unavailable, escalate with the original action and location evidence rather than repeatedly trying broader commands.\nVerification\nCheck the action outcome and the intended file on each approved device. Compare the actual restoration scope with the approved list and investigate unexpected releases. Preserve the safety determination and action record together. Review any requested exclusion separately, so restoring a wrongly quarantined file does not silently become a permanent reduction in inspection.\nOfficial references\nMicrosoft Learn: Address Defender for Endpoint false positives and negatives.", "content_markdown": "## Source facts\n\nDefender’s Action center history supports undoing an eligible quarantine action for one file. The interface can also apply an undo to additional instances of that file. An unavailable Undo button indicates that the selected action cannot be reversed there; actions performed through live response cannot be undone. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-endpoint/defender-endpoint-false-positives-negatives).\n\nMicrosoft’s command-line CustomEnterpriseBlock restoration example is broader: its warning says it restores all custom-blocked files quarantined on that device during the preceding thirty days. The source also warns that a file quarantined as a potential network threat might not be recoverable. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-endpoint/defender-endpoint-false-positives-negatives).\n\n## Applicability\n\nThis brief concerns Windows Defender for Endpoint false-positive remediation and quarantined files. Establish that the file is safe before choosing a restoration method. Restoring an artifact and changing future protection policy are separate decisions.\n\n## DSE recommendation\n\nDSE recommends starting with the completed action’s details and an explicit list of intended file instances and devices. Review any expanded instance selection before executing an undo. Do not translate one approved release into approval for every custom-blocked artifact from the same device. If restoration is unavailable, escalate with the original action and location evidence rather than repeatedly trying broader commands.\n\n## Verification\n\nCheck the action outcome and the intended file on each approved device. Compare the actual restoration scope with the approved list and investigate unexpected releases. Preserve the safety determination and action record together. Review any requested exclusion separately, so restoring a wrongly quarantined file does not silently become a permanent reduction in inspection.\n\n## Official references\n\n[Microsoft Learn: Address Defender for Endpoint false positives and negatives](https://learn.microsoft.com/en-us/defender-endpoint/defender-endpoint-false-positives-negatives)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-106-check-the-restoration-scope-before-undoing-a-defender-false-positive/", "url": "https://update.dsesecurity.com/updates/dse-20260909-106-check-the-restoration-scope-before-undoing-a-defender-false-positive/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-106-check-the-restoration-scope-before-undoing-a-defender-false-positive/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check the restoration scope before undoing a Defender false positive", "item": "https://update.dsesecurity.com/updates/dse-20260909-106-check-the-restoration-scope-before-undoing-a-defender-false-positive/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-106-check-the-restoration-scope-before-undoing-a-defender-false-positive/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-106-check-the-restoration-scope-before-undoing-a-defender-false-positive/", "url": "https://update.dsesecurity.com/updates/dse-20260909-106-check-the-restoration-scope-before-undoing-a-defender-false-positive/", "headline": "Check the restoration scope before undoing a Defender false positive", "description": "How can a quarantined-file restoration affect more than the single file an analyst intended to release?", "abstract": "How can a quarantined-file restoration affect more than the single file an analyst intended to release?", "articleBody": "Source facts\nDefender’s Action center history supports undoing an eligible quarantine action for one file. The interface can also apply an undo to additional instances of that file. An unavailable Undo button indicates that the selected action cannot be reversed there; actions performed through live response cannot be undone. Microsoft Learn.\nMicrosoft’s command-line CustomEnterpriseBlock restoration example is broader: its warning says it restores all custom-blocked files quarantined on that device during the preceding thirty days. The source also warns that a file quarantined as a potential network threat might not be recoverable. Microsoft Learn.\nApplicability\nThis brief concerns Windows Defender for Endpoint false-positive remediation and quarantined files. Establish that the file is safe before choosing a restoration method. Restoring an artifact and changing future protection policy are separate decisions.\nDSE recommendation\nDSE recommends starting with the completed action’s details and an explicit list of intended file instances and devices. Review any expanded instance selection before executing an undo. Do not translate one approved release into approval for every custom-blocked artifact from the same device. If restoration is unavailable, escalate with the original action and location evidence rather than repeatedly trying broader commands.\nVerification\nCheck the action outcome and the intended file on each approved device. Compare the actual restoration scope with the approved list and investigate unexpected releases. Preserve the safety determination and action record together. Review any requested exclusion separately, so restoring a wrongly quarantined file does not silently become a permanent reduction in inspection.\nOfficial references\nMicrosoft Learn: Address Defender for Endpoint false positives and negatives.", "datePublished": "2026-09-10T00:30:10+00:00", "dateModified": "2026-09-10T00:52:38+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-106-check-the-restoration-scope-before-undoing-a-defender-false-positive/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-106-check-the-restoration-scope-before-undoing-a-defender-false-positive/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check the restoration scope before undoing a Defender false positive" }, "articleSection": [ "Business Continuity", "Cybersecurity" ], "keywords": [ "Business Continuity", "Cybersecurity", "Playbook", "Information priority" ], "genre": "Playbook", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" } ], "wordCount": 258, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Address false positives/negatives in Microsoft Defender for Endpoint - Microsoft Defender for Endpoint | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-endpoint/defender-endpoint-false-positives-negatives" } } ] } }