Defender Exclusions¶
An exclusion tells Defender not to scan a folder, file, extension, or process. Legitimate uses exist but are rare and specific. On an image, an exclusion for C:\, C:\Users, or the .exe extension is a hole cut so malware can sit unscanned.
List them¶
Get-MpPreference | Select ExclusionPath, ExclusionExtension, ExclusionProcess
ExclusionPath : {C:\, C:\Users\bob\Downloads}
ExclusionExtension : {exe, bat, ps1}
ExclusionProcess : {}
Every entry there needs a justification. These have none.
GUI: Windows Security → Virus & threat protection → Manage settings → Exclusions → Add or remove exclusions.
Remove them¶
Remove-MpPreference -ExclusionPath "C:\"
Remove-MpPreference -ExclusionPath "C:\Users\bob\Downloads"
Remove-MpPreference -ExclusionExtension "exe","bat","ps1"
Or clear everything:
$p = Get-MpPreference
if ($p.ExclusionPath) { Remove-MpPreference -ExclusionPath $p.ExclusionPath }
if ($p.ExclusionExtension) { Remove-MpPreference -ExclusionExtension $p.ExclusionExtension }
if ($p.ExclusionProcess) { Remove-MpPreference -ExclusionProcess $p.ExclusionProcess }
Exclusions set by policy¶
Exclusions can also come from Group Policy, which Remove-MpPreference can't touch. gpedit.msc → Computer Configuration → Administrative Templates → Windows Components → Microsoft Defender Antivirus → Exclusions: all three entries should be Not Configured.
Registry: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\ should be empty or absent.
Verify¶
Get-MpPreference | Select ExclusionPath, ExclusionExtension, ExclusionProcess
All three empty. Then run a quick scan; anything the exclusions were hiding gets found now.