Confirm which security product and policy manage the server. Local Defender Antivirus, an onboarded Defender for Endpoint service and a separate management portal are related but distinct capabilities. Use the tools actually available to the authorised operator.

1. Open an appropriately authorised PowerShell session and run Get-MpComputerStatus to inspect the local Defender Antivirus state and protection information.
2. Run Get-MpThreatDetection to review individual detections. Record the relevant time, resource and reported action or remediation state.
3. Use Get-MpThreat for the threat-level view. Multiple detections of the same threat can be grouped there, so use the detailed view when building a timeline.
4. Correlate the affected file or process with the hosted application, recent upload, deployment and Windows events. Preserve useful evidence before replacing or restoring files.
5. Follow the approved incident process for containment and remediation. If updating intelligence or running a further scan is appropriate, use the supported management tool; PowerShell provides Update-MpSignature and Start-MpScan.
6. After the action completes, review its result and test the affected service. Record any unresolved detection or business impact.

Check the file's provenance, vendor release and relevant detection details before allowing or restoring it. Do not exclude an entire website directory simply because a required file was quarantined. Use the security owner's supported false-positive review process and scope any justified exception precisely.

Local PowerShell settings can be superseded by centrally managed policy. Make policy corrections through the owner of that policy so a temporary local change does not become an undocumented conflict.

On a Windows Server that uses Microsoft Defender Antivirus, open an authorised PowerShell session and inspect the detection history. This command reads reported detections. It does not restore quarantined files, add exclusions or disable protection.

Get-MpThreatDetection |
  Select-Object InitialDetectionTime, LastThreatStatusChangeTime,
    ThreatID, ActionSuccess, Resources

Read the result: Correlate the resource path and detection time with the affected application or upload. ActionSuccess describes the recorded response, not a complete investigation of the server. A valid application failure after quarantine needs the detected file assessed before it is restored.

Preserve the evidence and check the detection details through the supported Defender interface. Avoid publishing customer file paths or confidential content. If a false positive is suspected, use the vendor's submission and review process rather than excluding an entire hosting directory or releasing every detection.

• Investigating a Windows service failure with Event Viewer
• Applying Windows Server updates with a maintenance plan
• Planning Windows Server Backup and a test restore
• Keep a useful timeline during a hosting incident

• Microsoft: review Defender Antivirus scan results
• Microsoft: Defender Antivirus PowerShell commands
• Microsoft: performance, event and service data

• Microsoft: Defender detection history