PC 'Severe Threat' in Windows Security: What Quarantine Does and Doesn't Do
In plain English: Seeing 'severe threat' in Windows Security usually means Microsoft Defender already caught a risky file and quarantined it, so it cannot run or do harm. That word 'severe' sounds like damage is already done, but it is a rating of the threat, not a report on your PC.
First safe step: Open Protection History to check. If it says quarantined or removed, the job is usually done, with no panic and no payment needed.
Seeing 'severe threat' in Windows Security usually means Microsoft Defender already caught a risky file and quarantined it, so it cannot run or do harm. Open Protection History to check. If it says quarantined or removed, the job is usually done, with no panic and no payment needed.
That word 'severe' sounds like damage is already done, but it is a rating of the threat, not a report on your PC. Protection History works like a report card. It lists each item and the action Defender took, so you can see the result for yourself instead of guessing.
A real Windows Security alert does not ask you to call a number, buy software, or pay to release your PC. Browser pop-ups that do that are fakes, even when they copy Microsoft colors and logos. Close that tab and check Protection History in Windows Security instead.
Part of the Is This Microsoft Message Real? Fake Warnings, Real Defender Alerts and What To Do series, the pillar guide for this cluster.
What 'severe threat' actually means in Windows Security
'Severe' is the highest rating Microsoft Defender gives a threat. The rating describes the type of file found, what that kind of program is built to do, and how easily it can spread to other files or computers. A program rated severe might be built to steal information, lock files for ransom, or let an outsider control the PC.
That rating is not proof of damage on your PC. It does not by itself mean your passwords were read, your photos or documents were copied, or money was taken from an account. It also does not mean Windows is ruined and needs to be replaced or repaired for a fee.
Defender uses the same standard wording for every detection with this rating. You will see the same 'severe threat' line if a file sat in a folder for days and if Defender caught it seconds after it arrived, before it could run. The wording alone cannot tell you how long the file was there or what happened next.
The useful facts are lower in the alert details, so note them before you click anything. Write down the detection name, such as a name starting with Trojan or Ransomware, the date and time found, and the affected file name and its location. Those details identify the exact find if you need to look it up later.
What quarantine does to a file
Quarantine means Defender takes the named file out of its original place and holds it in a separate, protected area on the PC. While it is held there, the file cannot run, cannot open in its usual way, and cannot spread to other files or programs from that location. Think of it as a locked box for that one file.
That holding step is different from deletion. Defender has not erased the file, so it still shows as an entry in Protection History rather than vanishing without a record. Removal is a later, separate action. When a file is removed, Defender deletes it instead of keeping a held copy. Until that happens, quarantined is an accurate description: held apart, not gone.
In most cases, this happens automatically as soon as Defender detects the file, without you clicking a button or moving anything yourself. You may only see the alert after quarantine is already in place. The notice is reporting a step Defender has taken, not asking you to do that same step by hand. That timing is normal for Defender scans and real-time protection.
Quarantine is also narrow in scope. It applies only to the specific files Defender listed as affected items, for example a downloaded program or a file that arrived as an attachment. It does not lock up your photos, documents, or other personal files as a group, and those files stay where you left them. The rest of the PC is not put in quarantine.
What quarantine does not do
Quarantine does not come with a bill. Microsoft Defender does the hold as part of Windows Security, with no fee to finish it, no gift cards to buy, and no support number to call. If a message ties quarantine to payment or a call, that message is not Defender finishing its work.
It also does not fix what is already broken. Quarantine does not repair a program the file damaged, and it does not undo changes the file made before Defender found it. If an app still fails after quarantine, that is a separate repair or reinstall, not a missed quarantine step.
Quarantine covers the files Defender listed, not every copy anywhere. Another copy in your Downloads folder, an email attachment, or a USB drive can still sit there untouched until Defender scans and lists it. Deleting a download you do not trust is fine, but you do not need to wipe your photos or other personal files.
A single quarantined file does not mean the whole PC is infected. It is not, by itself, a reason to buy a cleaner program, pay for remote support, or let a stranger take control of your screen. In the common case, there is nothing left to pay someone else to complete.
How to read Protection History like a report card
Protection History is the list to check first. It shows what Defender found, when it found it, and what it did next, with the newest items at the top. Read it like a report card, one entry at a time. You do not need to guess from the short wording on the alert alone. Each entry stays on the list, so you can check it later without reopening the alert.
To open it, follow these steps.
- Open Windows Security from the Start menu.
- Select Virus and threat protection.
- Select Protection History.
- Select the newest entry that matches your alert, and read the full details that open below it.
If the list is long, start with the top entry and work down by date.
Read the status line first. Quarantined means Defender isolated the file so it cannot run. Removed means Defender deleted the file. Allowed means the item was let through, usually because someone selected Allow on this device for it. The first two statuses mean Defender completed its action for that entry. Do not judge the entry by the detection name alone. The status tells you the result.
Now read the rest of the same entry with that status. Note the date, the detection name, and the affected items listed there. Those details show which file was involved and when it was found. An entry marked Quarantined or Removed, with no action request, is a completed record. Treat Action needed, or a note that an action failed, as the real warning sign.
Do not press Allow or Restore to clear the list or make the warning go away. Those buttons can let the file run or put it back where it was. Use them only if you can name the file yourself and you trust where it came from. If you cannot, leave the entry as it is. The list does not need to be emptied.
When a severe rating needs no panic and no payment
When a severe rating needs no panic and no payment
If the newest Protection History entry says Quarantined or Removed and lists no action as needed, Defender has finished the job for that file. You can close Windows Security and use your PC as usual. The word severe still sounds alarming, but in this case there is nothing left for you to fix.
No payment is due for this result. Microsoft does not charge to keep a file quarantined, to remove it, or to open Protection History and read the entry. If a message asks for a card, a gift card, or a call to pay for any of those steps, do not pay it.
For extra reassurance, run one Quick scan. Open Virus and threat protection in Windows Security and select Quick scan. If the scan finishes and reports no threats, that is enough confirmation for most home readers in this situation, with no second program and no paid check needed.
Leave the entry in Protection History. It is your record of what was found and what was done, and you do not need to clear the history to stay protected. There is also no need to open, restore, or allow the file just to make the warning go away.
When a severe threat does need action now
Some entries are not finished. Act now if Protection History says Action needed, if quarantine or removal failed, or if the same threat name comes back after a new scan. A threat that returns points to a copy or a related file that Defender has not cleared yet. These signs are less common than a finished quarantine, but they are the ones to take seriously first.
Open that entry and use the action offered there, such as Remove or Quarantine. Then restart the PC, open Windows Security again, and run a Quick scan. Wait for that scan to finish before deciding whether the problem is gone, and check Protection History again for a new entry.
Act sooner if you selected Allow on this device by mistake, or if new warnings keep appearing while you use the PC for normal tasks. Do not open the file, and do not restore it. Run the action on the entry, or start a Quick scan, and note what changes.
If the entry names a Trojan detection, such as a Trojan:Win32 name, follow the page for that exact detection instead of guessing from the severity rating alone. If you think someone else controlled your PC remotely, use the first steps for suspected remote access next.
Frequently asked questions
Can a quarantined file still run on my PC?
No. Defender holds it away from its original place, so it cannot run or open in its usual way. Leave it quarantined unless you can name the file and trust where it came from.
Do I ever need to pay to complete quarantine?
No. Microsoft does not charge to quarantine or remove a threat, or to read Protection History. A message that asks for a call, payment, or gift cards did not come from a real Windows Security alert.
What should I do if the status says Allowed?
Treat it as unfinished if you did not mean to allow the file. Open that entry in Protection History, use the action shown there, restart the PC, and run a Quick scan again.
Conclusion
The word severe will probably still sting the next time you see it. Read past it to the status line in Protection History. That one word, Quarantined or Removed, tells you more about your PC right now than the rating does.
If that status is clear and no action is listed, you can close Windows Security and get back to what you were doing. No call, no payment, and no extra program is part of finishing the job. That quiet ending is the normal one for a quarantined threat.