---
title: "How do I find Windows Defender block events?"
url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/how-do-i-find-windows-defender-block-events"
language: "en"
last_updated: "2026-05-29T02:00:26.819Z"
---

# How do I find Windows Defender block events?

To find Windows Defender block events, you need to look in a specific sub-section of the Windows Event Viewer.

Defender does not log its blocks in the standard "System" or "Application" logs; it has its own dedicated operational log.

## 1\. Navigate to the Defender Log

1.  Open **Event Viewer** (`eventvwr.msc`).
2.  In the left-hand tree, navigate to: **Applications and Services Logs >** ***Microsoft***  
    ***Windows > Windows Defender > Operational***

## 2\. Filter for Block Events

Once you are in the **Operational** log, use the filter to find the specific actions Defender took against Spirion:

1.  Click **Filter Current Log...** in the right-hand Actions pane.
2.  In the **Event IDs** box, enter: `1116, 1117`
3.  -   **1116:** Indicates that Defender **detected** a threat (this happens if it flags `spirion.exe` or a file Spirion is reading).
    -   **1117:** Indicates that Defender **took action** (blocked, quarantined, or deleted the file).
4.  Click **OK**.

## 3\. What to look for in the Event Details

Click on one of the filtered events and look at the **General** tab:

-   **Process Name:** Look for `spirion.exe`. If Defender blocked Spirion, it will be listed as the process that triggered the detection.
-   **Path:** This will show the file Spirion was trying to touch when the block occurred.
-   **Detection Name:** Defender might label Spirion's behavior as `Behavior:Win32/Ransomware.Generic` or `Program:Win32/CompromisedTool` because of the high volume of file touches.

* * *

## 4\. Checking for "Attack Surface Reduction" (ASR) Blocks

If your organization uses **ASR rules** (a feature of Defender for Endpoint), Spirion might be blocked by a "Behavioral" rule rather than a malware signature. These are logged in a different place:

1.  Navigate to **Applications and Services Logs >** ***Microsoft Windows > Windows Defender > WHC*** *(Windows Host Checker) or* ***Exploit Guard***.
2.  Look for **Event ID 1121** or **1122**.
3.  These events will tell you if a specific rule (like "Block process creations originating from PSExec") stopped the Spirion Agent from running.

## 5\. Checking for "Controlled Folder Access"

If Defender's "Controlled Folder Access" is turned on, it will block Spirion from writing to protected folders (like Documents or Network Shares).

-   **Event ID:** `1123`
-   **Log Path:** Same as the standard Operational log above.
-   **Message:** "Your administrator has blocked this app from making changes to your folders."

* * *

## Troubleshooting Tip

If you find these events, you have confirmed that the "Access Denied" error is **not** a permission issue, but a **security software block**.

### The Fix

Take the Detection Name and the Process Path to your Security/AV team and request an Exclusion for the `spirion.exe` binary and the `Spirion, LLC` digital signature.

## Summary

Go to **Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational** and filter for **Event IDs 1116 and 1117**.