Skip to content

Defender Exclusions

An exclusion tells Defender not to scan a folder, file, extension, or process. Legitimate uses exist but are rare and specific. On an image, an exclusion for C:\, C:\Users, or the .exe extension is a hole cut so malware can sit unscanned.

List them

Get-MpPreference | Select ExclusionPath, ExclusionExtension, ExclusionProcess

ExclusionPath      : {C:\, C:\Users\bob\Downloads}
ExclusionExtension : {exe, bat, ps1}
ExclusionProcess   : {}

Every entry there needs a justification. These have none.

GUI: Windows Security → Virus & threat protection → Manage settings → Exclusions → Add or remove exclusions.

Remove them

Remove-MpPreference -ExclusionPath "C:\"
Remove-MpPreference -ExclusionPath "C:\Users\bob\Downloads"
Remove-MpPreference -ExclusionExtension "exe","bat","ps1"

Or clear everything:

$p = Get-MpPreference
if ($p.ExclusionPath)      { Remove-MpPreference -ExclusionPath $p.ExclusionPath }
if ($p.ExclusionExtension) { Remove-MpPreference -ExclusionExtension $p.ExclusionExtension }
if ($p.ExclusionProcess)   { Remove-MpPreference -ExclusionProcess $p.ExclusionProcess }

Exclusions set by policy

Exclusions can also come from Group Policy, which Remove-MpPreference can't touch. gpedit.msc → Computer Configuration → Administrative Templates → Windows Components → Microsoft Defender Antivirus → Exclusions: all three entries should be Not Configured.

Registry: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\ should be empty or absent.

Verify

Get-MpPreference | Select ExclusionPath, ExclusionExtension, ExclusionProcess

All three empty. Then run a quick scan; anything the exclusions were hiding gets found now.

Try it

  1. Add an exclusion for C:\Temp in the Settings app, find it with Get-MpPreference, and remove it with Remove-MpPreference.
  2. Read the exclusion list on a practice image and decide for each entry whether the README explains it.

Build it

Add exclusion listing to defender.ps1, and a -Clear switch that removes every exclusion not in an allow file.

Next

Defender Actions and PUA