Security Policy Errors

How to Find Vulnerable File Paths in Microsoft Defender

Kushani Nimanthika Oct 12, 2026 868 views

Question details

Users need to find the exact installation file paths of vulnerable software identified by Microsoft Defender for Endpoint across their environment.

How to Find Vulnerable File Paths in Microsoft Defender

Product: Microsoft Defender for Endpoint
Device & OS: Windows Server
Scenario: Administrators are trying to locate the exact file paths (e.g., specific .jar files or applications) of identified vulnerabilities to perform remediation, but are struggling to find them natively in Defender compared to tools like Rapid7 or Nessus.
Observed behavior: Microsoft Defender flags the vulnerability on the server, but users find it difficult to locate the specific vulnerable file paths in the security center interface.

Before you start

Ensure you have the necessary administrative permissions in the Microsoft 365 Defender portal to view device inventories and run advanced hunting queries.

Solution 1Recommended

Locate File Paths via Device Software Inventory

For individual servers or endpoints, you can manually inspect the exposed device's software inventory to find the exact installation path of the vulnerable application.

This method is best when you only need to investigate a handful of isolated servers. It allows you to drill down into a specific endpoint's installed software and verify where the vulnerable files reside.

Open Microsoft 365 Defender

Select the Affected Device

Search for and select the specific Windows Server or endpoint that has been flagged with the software vulnerability.

View Software Inventory

On the device's detail page, click on the 'Software inventory' tab to load the list of applications detected on the machine.

Locate the Software Path

Search for the specific software associated with the vulnerability (e.g., Elasticsearch or Log4j). Click on the software entry to view its details, which will display the full installation path.

Locate File Paths via Device Software Inventory

Solution 2

Export Vulnerability Data Using Advanced Hunting

If you have a large environment with many affected assets, use Advanced Hunting queries to bulk export device and file path information.

Free Microsoft Office alternative

Analyze Defender Vulnerability Reports with WPS Office

When you export bulk vulnerability data and file paths from Microsoft Defender's Advanced Hunting, you need a reliable spreadsheet tool to analyze the CSV files. WPS Office provides a lightweight, highly compatible, and free alternative to Microsoft Office, allowing you to seamlessly open, filter, and report on large security logs.

1. Download and Install: Download WPS Office for free from the official website and install it on your workstation.
2. Open Exported Logs: Launch WPS Spreadsheet and open the CSV file you exported from Microsoft Defender Advanced Hunting.
3. Analyze the Data: Use built-in data filters, text-to-columns features, and pivot tables to track vulnerable file paths across your Windows servers efficiently.

Fully compatible with Microsoft Excel (.xlsx) and CSV formats for opening exported Defender logsFree and lightweight, ensuring fast loading times even for massive security datasetsFamiliar spreadsheet interface requires no learning curve for immediate productivity

microsoft office alternative - wps office

Frequently Asked Questions

Why doesn't Microsoft Defender show the Vulnerable files tab directly like Nessus?

Microsoft Defender approaches vulnerability management through comprehensive software and device inventories. While tools like Nessus or Rapid7 might surface the direct file path in an immediate scan summary, Defender tracks it natively through the endpoint's Software inventory tab, which requires navigating to the specific device's page.

Can I find vulnerable Java archive (.jar) paths in Microsoft Defender?

Yes. By navigating to a device's Software inventory tab or by using Advanced Hunting queries, you can locate specific installation paths for vulnerable libraries, such as log4j-core .jar files, provided they have been scanned and indexed by the Defender sensor on that server.

How do I avoid manually checking each server for a vulnerability path?

Instead of inspecting the Software inventory tab for each device manually, you should use the Advanced hunting feature. By writing KQL queries, you can aggregate vulnerability findings and software inventory paths, allowing you to export a complete list of affected assets and their file locations in a single action.

Microsoft Office Security Issues