How do I find Windows Defender block events?

Defender does not log its blocks in the standard "System" or "Application" logs; it has its own dedicated operational log.

1. Navigate to the Defender Log

1. Open Event Viewer (eventvwr.msc).
2. In the left-hand tree, navigate to: Applications and Services Logs > Microsoft
   Windows > Windows Defender > Operational

2. Filter for Block Events

Once you are in the Operational log, use the filter to find the specific actions Defender took against Spirion:

1. Click Filter Current Log... in the right-hand Actions pane.
2. In the Event IDs box, enter: 1116, 1117
3. • 1116: Indicates that Defender detected a threat (this happens if it flags spirion.exe or a file Spirion is reading).
   • 1117: Indicates that Defender took action (blocked, quarantined, or deleted the file).
3. Click OK.

3. What to look for in the Event Details

Click on one of the filtered events and look at the General tab:

• Process Name: Look for spirion.exe. If Defender blocked Spirion, it will be listed as the process that triggered the detection.
• Path: This will show the file Spirion was trying to touch when the block occurred.
• Detection Name: Defender might label Spirion's behavior as Behavior:Win32/Ransomware.Generic or Program:Win32/CompromisedTool because of the high volume of file touches.

4. Checking for "Attack Surface Reduction" (ASR) Blocks

If your organization uses ASR rules (a feature of Defender for Endpoint), Spirion might be blocked by a "Behavioral" rule rather than a malware signature. These are logged in a different place:

1. Navigate to Applications and Services Logs > Microsoft Windows > Windows Defender > WHC (Windows Host Checker) or Exploit Guard.
2. Look for Event ID 1121 or 1122.
3. These events will tell you if a specific rule (like "Block process creations originating from PSExec") stopped the Spirion Agent from running.

5. Checking for "Controlled Folder Access"

If Defender's "Controlled Folder Access" is turned on, it will block Spirion from writing to protected folders (like Documents or Network Shares).

• Event ID: 1123
• Log Path: Same as the standard Operational log above.
• Message: "Your administrator has blocked this app from making changes to your folders."

Troubleshooting Tip

If you find these events, you have confirmed that the "Access Denied" error is not a permission issue, but a security software block.

The Fix

Take the Detection Name and the Process Path to your Security/AV team and request an Exclusion for the spirion.exe binary and the Spirion, LLC digital signature.

Summary

Go to Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational and filter for Event IDs 1116 and 1117.