Defender Support Logs
Windows Defender writes diagnostic support logs under ProgramData when Microsoft Defender Antivirus, its service components, or troubleshooting tools record scan activity, update events, engine errors, and platform diagnostics. This folder commonly accumulates plain-text trace logs, ETL event trace files, CAB packages, and crash or collection artifacts that are useful for support cases but can linger long after the issue is resolved. Kudu removes those stale Defender support logs and diagnostic bundles without touching malware definitions, protection settings, quarantine, accounts, or passwords.
Why clean Defender Support Logs?
- Large leftover MpSupportFiles.cab packages and verbose trace logs consume space in ProgramData, which users notice as unexplained disk usage on the system drive after troubleshooting or failed updates
- Old ETL and text diagnostics from previous engine or platform versions make current Defender troubleshooting harder, because new incidents get buried in obsolete entries and support collections become noisy
- Repeated support-log generation after scan or update failures can leave behind many timestamped archives, showing up as a rapidly growing Support folder even though real-time protection still appears enabled
- When the Support directory contains years of accumulated traces, security investigations take longer because admins must sort through stale crash and update records before finding the event that matches today's warning
- Failed or interrupted diagnostic collection can leave partial CABs and temporary trace output behind, which users observe as stranded files that never clean themselves up after a support session ends
- Machines with tight system-drive space can hit Windows low-disk warnings sooner because Defender diagnostic artifacts are stored under ProgramData, not in personal folders, so the space loss is easy to miss
Cache paths Kudu targets
Windows
%ProgramData%/Microsoft/Windows Defender/Support |
Common questions about Defender Support Logs
Download Kudu and reclaim your disk space.
Available on Windows, macOS, and Linux. No account required, no feature gates, no telemetry without consent. All cleaning targets are open source and community-auditable.