Verify the Windows Defender exclusions that are set using "Auto Exclusions".

Hi,

How did you configured Auto Exclusions? Through Powershell command line, registry or group policy?
What exclusion you added?

Make sure you find the correct path for corresponding exclusion item.
File and folder exclusions are stored in the registry key below.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
File type exclusions are stored in the registry key below.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions
Process exclusions are stored in the registry key below.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes

If you are using Group Policy to configure, try to run "gpresult /h gp.html" as administrator to check if any related information recorded.
Did you compared those value in registry or group policy result between configured and unconfigured devices?

I noticed the article: Add or Remove Microsoft Defender Antivirus Exclusions in Windows 10 below have a similar issue with you, and at last it resolve it by delete path key in registry key in second page.

Please note: Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.

Bests,

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

@Joy Qiao thanks for answering.

I have tried to verify the exclusions which are created using the " Auto Exclusions " function. The function is controlled by the Group Policies, so "Turn off Auto Exclusions" -> disabled.

For this purpose, I have set up a VM with Windows Server 2019 and installed the following roles there: Active Directory Domain Services, DHCP Server, DNS Server and the Web Servers (IIS). I have not defined any other exclusions.

So only the exclusions should be visible, which are made by the "Auto Exclusions" function. However, these are nowhere to be found.

Hi,

I make a test on Turn off Auto Exclusions and get the following behavior.

After I disabled "Turn off Auto Exclusions" in group policy and configured Path Exclusions to a specific value path such as C:\Program Files\Internet Explorer\images to value 0. It will not show up in group policy result report with running gpresult. Also it will not show up in registry key as path exclusions. But it will show up in UI in security Window in Settings.

After I run a customized scan and specific C:\Program Files\Internet Explorer to scan, it scan 31 files.

If I deleted configured group policy path exclusion value and perform a customized scan, it scan 32 files for C:\Program Files\Internet Explorer.

So that, even through the group policy is not show as actually configured, but it works well on clients.

So we could feedback the issue to Microsoft through Windows build-in Feedback Hub, I will also feedback it through our internal channel about it.

I know it could be make a confuse for IT administrator who will not know if there group policy successfully applied. At the existing status, we could choose few clients to check in Security UI windows for confirming exclusion group policy applied. Thank you for your understanding.

Bests,