Scan History of blocked apps

I'm out! I need to take a Xanax.

Protection history entries that show "This app has been blocked" are generated by Microsoft Defender SmartScreen or by features such as Controlled folder access. To see which app was blocked and its details, admin rights are required.

When selecting an item in Protection history and a User Account Control (UAC) dialog appears instead of the details, that dialog is prompting for administrator permission. Until an administrator account approves the prompt, Windows Security will not show the detailed information about the blocked app.

To see which app was blocked:

1. When the UAC dialog appears, enter credentials for an administrator account or choose Yes if already signed in as an administrator.
2. After elevation succeeds, the Protection history card can be expanded and will show the app name, path, and actions (for example, Allow or Quarantine / Allow on device).

Notes based on Protection history behavior:

• Protection history only keeps events for about two weeks; older events disappear from the list.
• Admin privileges are required to see threat details in Protection history.
• For malware detections, the Actions dropdown allows Quarantine or Allow on device; for potentially unwanted apps blocked by SmartScreen, the Actions button allows Allow so the file can be re-downloaded.
• If something was previously allowed and needs to be reversed, it can be removed from the allowed list via the Allowed threats page.

If the UAC prompt cannot be approved (for example, using a standard account without admin credentials), the blocked app details will not be visible from Protection history on that account.

References:

• Protection History
• Virus and Threat Protection in the Windows Security App