Configure exclusions for files opened by processes
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
- Microsoft Defender Antivirus
You can exclude files that are opened by specific processes from Microsoft Defender Antivirus scans. Note that these types of exclusions are for files that are opened by processes and not the processes themselves. To exclude a process, add a file exclusion (see Configure and validate exclusions based on file extension and folder location).
See Important points about exclusions and review the information in Manage exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus before defining your exclusion lists.
This article describes how to configure exclusion lists.
Examples of exclusions
|Any file on the machine that is opened by any process with a specific file name||Specifying
|Any file on the machine that is opened by any process under a specific folder||Specifying
|Any file on the machine that is opened by a specific process in a specific folder||Specifying
When you add a process to the process exclusion list, Microsoft Defender Antivirus won't scan files opened by that process, no matter where the files are located. The process itself, however, will be scanned unless it has also been added to the file exclusion list.
The exclusions only apply to always-on real-time protection and monitoring. They don't apply to scheduled or on-demand scans.
Changes made with Group Policy to the exclusion lists will show in the lists in the Windows Security app. However, changes made in the Windows Security app will not show in the Group Policy lists.
You can add, remove, and review the lists for exclusions in Group Policy, Microsoft Configuration Manager, Microsoft Intune, and with the Windows Security app, and you can use wildcards to further customize the lists.
You can also use PowerShell cmdlets and WMI to configure the exclusion lists, including reviewing your lists.
By default, local changes made to the lists (by users with administrator privileges; changes made with PowerShell and WMI) are merged with the lists as defined (and deployed) by Group Policy, Configuration Manager, or Intune. The Group Policy lists take precedence if there are conflicts.
You can configure how locally and globally defined exclusions lists are merged to allow local changes to override managed deployment settings.
Network Protection and Attack surface reduction rules are directly impacted by process exclusions on all platforms, meaning that a process exclusion on any OS (Windows, MacOS, Linux) will result in Network Protection or ASR being unable to inspect traffic or enforce rules for that specific process.
Configure the list of exclusions for files opened by specified processes
Use Microsoft Intune to exclude files that have been opened by specified processes from scans
Use Microsoft Configuration Manager to exclude files that have been opened by specified processes from scans
See How to create and deploy antimalware policies: Exclusion settings for details on configuring Microsoft Configuration Manager (current branch).
Use Group Policy to exclude files that have been opened by specified processes from scans
On your Group Policy management computer, open the Group Policy Management Console, right-click the Group Policy Object you want to configure and click Edit.
In the Group Policy Management Editor, go to Computer configuration and click Administrative templates.
Expand the tree to Windows components > Microsoft Defender Antivirus > Exclusions.
Double-click Process Exclusions and add the exclusions:
- Set the option to Enabled.
- Under the Options section, click Show....
- Enter each process on its own line under the Value name column. See the example table for the different types of process exclusions. Enter 0 in the Value column for all processes.
Use PowerShell cmdlets to exclude files that have been opened by specified processes from scans
Using PowerShell to add or remove exclusions for files that have been opened by processes requires using a combination of three cmdlets with the
-ExclusionProcess parameter. The cmdlets are all in the Defender module.
The format for the cmdlets is:
<cmdlet> -ExclusionProcess "<item>"
The following are allowed as the <cmdlet>:
|Configuration action||PowerShell cmdlet|
|Create or overwrite the list||
|Add to the list||
|Remove items from the list||
If you have created a list, either with
Add-MpPreference, using the
Set-MpPreference cmdlet again will overwrite the existing list.
For example, the following code snippet would cause Microsoft Defender Antivirus scans to exclude any file that is opened by the specified process:
Add-MpPreference -ExclusionProcess "c:\internal\test.exe"
For more information on how to use PowerShell with Microsoft Defender Antivirus, see Manage antivirus with PowerShell cmdlets and Microsoft Defender Antivirus cmdlets.
Use Windows Management Instruction (WMI) to exclude files that have been opened by specified processes from scans
Use the Set, Add, and Remove methods of the MSFT_MpPreference class for the following properties:
The use of Set, Add, and Remove is analogous to their counterparts in PowerShell:
For more information and allowed parameters, see Windows Defender WMIv2 APIs.
Use the Windows Security app to exclude files that have been opened by specified processes from scans
See Add exclusions in the Windows Security app for instructions.
Use wildcards in the process exclusion list
The use of wildcards in the process exclusion list is different from their use in other exclusion lists.
In particular, you can't use the question mark (
?) wildcard, and the asterisk (
*) wildcard can only be used at the end of a complete path. You can still use environment variables (such as
%ALLUSERSPROFILE%) as wildcards when defining items in the process exclusion list.
The following table describes how the wildcards can be used in the process exclusion list:
|Wildcard||Example use||Example matches|
Replaces any number of characters
||Any file opened by
The defined variable is populated as a path when the exclusion is evaluated
||Any file opened by
Review the list of exclusions
If you use PowerShell, you can retrieve the list in two ways:
- Retrieve the status of all Microsoft Defender Antivirus preferences. Each of the lists are displayed on separate lines, but the items within each list are combined into the same line.
- Write the status of all preferences to a variable, and use that variable to only call the specific list you're interested in. Each use of
Add-MpPreferenceis written to a new line.
Validate the exclusion list by using MpCmdRun
To check exclusions with the dedicated command-line tool mpcmdrun.exe, use the following command:
MpCmdRun.exe -CheckExclusion -path <path>
Checking exclusions with MpCmdRun requires Microsoft Defender Antivirus CAMP version 4.18.1812.3 (released in December 2018) or later.
Review the list of exclusions alongside all other Microsoft Defender Antivirus preferences by using PowerShell
Use the following cmdlet:
For more information on how to use PowerShell with Microsoft Defender Antivirus, see Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus and Microsoft Defender Antivirus cmdlets .
Retrieve a specific exclusions list by using PowerShell
Use the following code snippet (enter each line as a separate command); replace WDAVprefs with whatever label you want to name the variable:
$WDAVprefs = Get-MpPreference $WDAVprefs.ExclusionProcess
For more information on how to use PowerShell with Microsoft Defender Antivirus, see Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus and Microsoft Defender Antivirus cmdlets.
If you're looking for Antivirus related information for other platforms, see:
- Set preferences for Microsoft Defender for Endpoint on macOS
- Microsoft Defender for Endpoint on Mac
- macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune
- Set preferences for Microsoft Defender for Endpoint on Linux
- Microsoft Defender for Endpoint on Linux
- Configure Defender for Endpoint on Android features
- Configure Microsoft Defender for Endpoint on iOS features
- Configure and validate exclusions in Microsoft Defender Antivirus scans
- Configure and validate exclusions based on file name, extension, and folder location
- Configure Microsoft Defender Antivirus exclusions on Windows Server
- Common mistakes to avoid when defining exclusions
- Customize, initiate, and review the results of Microsoft Defender Antivirus scans and remediation
- Microsoft Defender Antivirus in Windows 10
Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender for Endpoint Tech Community.