What did Windows Security just warn me about?

Open Windows Security and select Protection history to check a missed Defender warning. If you need the exact wording of the popup, look in a notification log that was already running when it arrived. These records answer different questions: what Defender did, and what Windows displayed.

Start with the security record before deciding whether an alert needs action. A disappearing banner does not tell you whether a threat was removed, blocked or still needs attention.

Open the security record from Windows

Use Start to search for Windows Security, then open Protection history. Microsoft's Protection History guide says this view includes Defender actions, removed potentially unwanted apps and important security services that were turned off. Events remain in the list for two weeks, and viewing threat details requires administrator privileges.

Expand the relevant event and compare its time, affected item and status with what you were doing. Read the current status in Windows Security; a saved popup may describe an earlier stage of the same event.

On a work computer, send the event details to your IT team through the approved channel if you cannot inspect or resolve them yourself. Do not change protection settings to make a warning disappear.

Choose the record that answers your question

The Event Viewer comparison explains the broader difference between system events and popup text. For this task, opening the antivirus record is usually the more direct first step.

Find the popup text in Notification Logger

If Notification Logger was already capturing alerts, narrow its history to the period when you saw the warning. Review the sender names, then search for a phrase you remember. Sender labels and wording can vary with the security product and Windows language.

Read the saved text beside the timestamp and compare it with the event in Windows Security. If you need to revisit the entry, the user manual explains favourites: they are protected from automatic retention cleanup until you remove the favourite marker.

The logger receives notifications exposed by Windows. It does not inspect quarantined files or collect every message shown inside a security app. A missing log entry does not establish that no security event occurred. It also cannot reconstruct a popup that disappeared before capture; see the cleared-notification recovery guide.

Distinguish Windows Security from a website warning

Check the sender before following a popup. A browser notification saying your computer is infected is not the same record as an event in Windows Security. Open Windows Security from Start and inspect it independently rather than calling a number or installing a tool advertised in the alert.

If the source is an unwanted website, use the browser notification cleanup guide. The fake-alert guide covers misleading security messages in more detail.

Keep enough evidence without spreading private details

For a support request, record the event time, the security application's name and its current status. File paths and notification text can contain account names or document titles. Share only what the support team needs, and review screenshots before sending them.

Once you have checked the warning, leave remediation decisions in the security application or with your IT team. A notification archive is useful context for an investigation; the security tool remains the place to confirm what happened and what still needs action.

Windows Security instructions were checked against Microsoft documentation on 10 October 2026.

Frequently asked questions