I am trying to find more information on the alerts that come up from Windows Defender and include one of the following:

  • Remediation Status: What is it?, what are all the different types? and what each of them means?
  • Action Status: What is it?, what are all the different types? and what each of them means?
  • You mean, like this? docs.microsoft.com/en-us/windows/security/threat-protection/…
    – schroeder
    Commented Jan 29, 2019 at 11:48
  • I'm thinking that your answer will likely be found in Defender's documentation.
    – schroeder
    Commented Jan 29, 2019 at 11:49
  • Thank you for your prompt response. I could not find anything in this link unfortunately. The Defender documentation is something publicly available?
    – elli
    Commented Jan 29, 2019 at 11:55
  • Can you post an example of what you are looking for?
    – schroeder
    Commented Jan 29, 2019 at 11:58
  • 1
    This is looking like a Windows product documentation question. It looks like more of an SCCM interface to Defender question. docs.microsoft.com/en-us/sccm/protect/deploy-use/…
    – schroeder
    Commented Jan 29, 2019 at 12:11

1 Answer 1


From your description, it appears to not just be a Defender source, but an SCCM source of knowledge you need.


Malware Alert Levels Use the following table to identify the different Endpoint Protection alert levels that might be displayed in reports, or in the Configuration Manager console.

Alert level

Failed Endpoint Protection failed to remediate the malware. Check your logs for details of the error.

Note: For a list of Configuration Manager and Endpoint Protection log files, see the "Endpoint Protection" section in the Log files in System Center Configuration Manager topic.

Removed Endpoint Protection successfully removed the malware.

Quarantined Endpoint Protection moved the malware to a secure location and prevented it from running until you remove it or allow it to run.

Cleaned The malware was cleaned from the infected file.

Allowed An administrative user selected to allow the software that contains the malware to run.

No Action Endpoint Protection took no action on the malware. This might occur if the computer is restarted after malware is detected and the malware is no longer detected; for instance, if a mapped network drive on which malware is detected is not reconnected when the computer restarts.

Blocked Endpoint Protection blocked the malware from running. This might occur if a process on the computer is found to contain malware.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .