Microsoft Defender Antivirus event IDs and error codes: a quick reference

Microsoft Defender Antivirus records almost everything it does in one event log, and most failures surface either as an event ID or as an 0x8050xxxx code inside an event. This quick reference lists the events and client error codes in Microsoft's documentation, grouped by what's happening (scans and detections, updates, protection state), with the meaning, the usual cause and the first thing to check. Press Ctrl+F and type your ID or code.

How to read these codes#

Events are in Event Viewer under Applications and Services Logs › Microsoft › Windows › Windows Defender › Operational. To pull the interesting ones from PowerShell:

Get-WinEvent -FilterHashtable @{
    LogName = 'Microsoft-Windows-Windows Defender/Operational'
    Id      = 1116, 1117, 1119, 2001, 3002, 5007, 5013
} -MaxEvents 50 | Select-Object TimeCreated, Id, Message

• Event IDs are listed below with the symbolic name Microsoft uses for each (such as MALWAREPROTECTION_CONFIG_CHANGED), which helps when you search Microsoft's documentation.
• Error codes appear in the Error Code field of failure events such as 1008, 1119, 2001 and 3002. Microsoft describes them as standard HRESULT values; the 0x8050xxxx ones are Defender's own and are in the last table. Other values are general Windows codes.
• Attack surface reduction, network protection and controlled folder access write to the same log; see ASR rules in audit mode and web content filtering and network protection for their events.
• On devices onboarded to Defender for Endpoint, the same story is available centrally in advanced hunting, for example DeviceEvents rows with the action type AntivirusDetection; see advanced hunting for Intune admins.

Scans and detections#

Quarantine and client health#

Updates and cloud protection#

Protection state and configuration#

If several of these appear together after a policy change, start with Defender settings not applying. If Defender runs in passive mode next to another antivirus, some protections are off by design; see active, passive and EDR block mode.

Client error codes (0x8050xxxx)#

Microsoft notes that these errors most often point to a problem installing updates, so update definitions first, then work through the table.

Internal error codes#

Microsoft also lists internal codes it uses in its own testing: 0x80501000 to 0x80501004, 0x80501101 to 0x80501108, a set of codes between 0x80508001 and 0x80508019, 0x80509001, 0x80509003 and 0x8050A001 to 0x8050A005 (the ERR_MP_BADDB_* names). For most of them it doesn't define a cause; its advice is to update definitions and force a rescan directly on the device. Three have clearer hints: 0x80501004 ERROR_MP_NO_INTERNET_CONN means checking the internet connection and scanning again, 0x80508018 ERR_MP_SCAN_ABORTED can follow a failed scan, and ERR_MP_REMOVE_FAILED can follow an unsuccessful malware removal.

How to verify a fix#

Update-MpSignature
Get-MpComputerStatus | Select-Object AMRunningMode, AMProductVersion, AMEngineVersion,
    AntivirusSignatureVersion, AntivirusSignatureLastUpdated, RealTimeProtectionEnabled
Start-MpScan -ScanType QuickScan
Get-MpThreatDetection | Select-Object -First 5

• Update problems: new 2000 and 2002 events with current versions, and no new 2001, 2003 or 2005.
• Remediation problems: after a full or offline scan, a 1117 with a remediating action (Clean, Quarantine or Remove) and no new 1118 or 1119 for the same threat.
• Protection state: the next 1151 report shows RTP, OA, IOAV and BM as Enabled, AMRunningMode is Normal (or Passive by design), and no unexpected 5001, 5010 or 5012 appears after the next policy refresh.
• Tamper protection: no new 5013 once the change is made through the channel that owns the setting.

References#

• Microsoft Defender Antivirus event IDs and error codes (Microsoft Learn): the source for every event ID, symbolic name and error code on this page.