Check the restoration scope before undoing a Defender false positive

Source facts

Defender’s Action center history supports undoing an eligible quarantine action for one file. The interface can also apply an undo to additional instances of that file. An unavailable Undo button indicates that the selected action cannot be reversed there; actions performed through live response cannot be undone. Microsoft Learn.

Microsoft’s command-line CustomEnterpriseBlock restoration example is broader: its warning says it restores all custom-blocked files quarantined on that device during the preceding thirty days. The source also warns that a file quarantined as a potential network threat might not be recoverable. Microsoft Learn.

Applicability

This brief concerns Windows Defender for Endpoint false-positive remediation and quarantined files. Establish that the file is safe before choosing a restoration method. Restoring an artifact and changing future protection policy are separate decisions.

DSE recommendation

DSE recommends starting with the completed action’s details and an explicit list of intended file instances and devices. Review any expanded instance selection before executing an undo. Do not translate one approved release into approval for every custom-blocked artifact from the same device. If restoration is unavailable, escalate with the original action and location evidence rather than repeatedly trying broader commands.

Verification

Check the action outcome and the intended file on each approved device. Compare the actual restoration scope with the approved list and investigate unexpected releases. Preserve the safety determination and action record together. Review any requested exclusion separately, so restoring a wrongly quarantined file does not silently become a permanent reduction in inspection.

Official references

Microsoft Learn: Address Defender for Endpoint false positives and negatives.