How to check if Windows Defender generates random files and how to fix them

Over the past few days on Reddit and Microsoft forums, many users reported an issue with Windows Defender where it caused the user's disk to fill up. While some users complained about files as small as 2KB causing minor issues, many others reported seeing a lot of space occupied by thousands of files in the Windows Defender folder.

Microsoft Defender comes pre-installed on all versions of Windows 10 and is regularly updated through Windows Update. After the Windows Defender update in late April, many users noticed there were thousands of files in the system drive, showing up in the folder C: ProgramDataMicrosoftWindows DefenderScansHistoryStore.

The bug is also attacking Windows Server installations where some users report that it has generated 18 million files in their organization.

'We have three 2016 servers affected so far. The hard drive capacity warning started showing up last night. One server has 18 million files in the Store folder. Another machine has 13 million files. It took us hours just to find files and delete them. Due to size allocation, these files are taking up 50-60GB of disk space. This is a big bug from Microsoft ', one user shared on Reddit.

How to check if Windows Defender is creating file or not

The easiest way to check if Windows Defender has an error is through File Explorer:

Step 1. Open File Explorer and make sure "hidden items" are enabled on the View tab

Step 2. In the address bar, type C: ProgramData Microsoft

Step 3. Select Windows Defender

Step 4. Select Continue if the folder requires administrator privileges

Step 5. In the Windows Defender folder, navigate to Scans HistoryScans

If affected, you will see hundreds or thousands of files less than one MB per file. You can safely delete the files in the folder.

How to fix

The issue seems to have been fixed using Windows Defender engine 1.1.18100.6.

Step 1. Open Start Menu and select Settings gear icon. In the Settings app, navigate to Updates & Security -> Windows Update and tap check for updates.

Step 2. The new update is titled 'Security Intelligence Update for Microsoft Defender Antivirus' and will be downloaded and installed automatically.

Step 3. You can verify the security tool's version number by opening the About page in the Windows Defender app

Isabella Humphrey

Update 06 May 2021