Edit

Share via

Recommended antivirus exclusions for Hyper-V hosts

  • Article

This article describes the recommended antivirus exclusions for Hyper-V hosts for optimal operation.

Original KB number:   3105657

Summary

You may have antivirus software installed and running on a Hyper-V host. For optimal operation of Hyper-V and the running virtual machines, you should configure several exclusions and options. These configurations will help avoid issues, such as those that are described in the following article:

Virtual machines are missing, or error 0x800704C8, 0x80070037, or 0x800703E3 occurs when you try to start or create a virtual machine.

Use the information that's provided in the Configurations section to configure your antivirus software to coexist optimally with Hyper-V and your virtual machines.

Important

This article contains information that shows how to help lower security settings or how to turn off security features on a computer. You can make these changes to work around a specific problem. These specific configuration changes should be made only on the following systems:

  • Physical systems that are configured to have the Hyper-V role enabled and that have virtual machines currently running
  • Physical systems that may be providing storage for the virtual machine files, such as a Windows Server File Server.

For specific guidance about how to configure your antivirus software, work with your antivirus vendor.

Configurations

Configure the real-time scanning component within your antivirus software to exclude the following directories, files, and processes.

Note

If you are using Windows Defender as an anti-malware solution on your server, you may not need to configure additional exclusions. For a list of Windows Defender automatic exclusions, see List of automatic exclusions.

Files

All directories that contain the following files:

  • Virtual Hard Disk file (*.vhd)

  • Virtual Hard Disk v2 file (*.vhdx)

  • Virtual Hard Disk snapshot file (*.avhd)

  • Virtual Hard Disk v2 snapshot file (*.avhdx)

  • VHD Set file (*.vhds)

  • Virtual PMEM VHD file (*.vhdpmem)

  • Virtual Optical Disk images (*.iso)

  • Resilient Change Tracking file (*.rct)

  • Modified Region Table file (*.mrt)

  • Device state file (*.vsv)

    The processes that create, open, or update the file: vmms.exe, vmwp.exe, vmcompute.exe.

  • Memory state file (*.bin)

    The processes that create, open, or update the file: vmwp.exe

  • VM Configuration file (*.xml)

    The processes that create, open, or update the file: vmms.exe

  • VM Configuration v2 file (*.vmcx)

    The processes that create, open, or update the file: vmms.exe

  • VM Runtime State file (*.vmrs)

    The processes that create, open, or update the file: vmms.exe, vmwp.exe, vmcompute.exe.

  • VM Guest State file (*.vmgs)

Directory

  • The default virtual machine configuration directory, if it's used, and any of its subdirectories:

    %ProgramData%\Microsoft\Windows\Hyper-V

  • The default virtual machine virtual hard disk files directory, if it's used, and any of its subdirectories:

    %Public%\Documents\Hyper-V\Virtual Hard Disks

  • The default snapshot files directory, if it's used, and any of its subdirectories:

    %SystemDrive%\ProgramData\Microsoft\Windows\Hyper-V\Snapshots

  • The default Cluster Shared Volumes path, if you're using Cluster Shared Volumes, and any of its subdirectories:

    C:\ClusterStorage

  • Any custom virtual machine configuration directories, if applicable

  • Any custom virtual hard disk drive directories, if applicable

  • Any custom replication data directories, if you're using Hyper-V Replica

  • If antivirus software is running on your file servers, any Server Message Block protocol 3.0 (SMB 3.0) file shares on which you store virtual machine files.

Process

  • Vmms.exe (%systemroot%\System32\Vmms.exe)

    This file may have to be configured as a process exclusion within the antivirus software.

  • Vmwp.exe (%systemroot%\System32\Vmwp.exe)

    This file may have to be configured as a process exclusion within the antivirus software.

  • Vmsp.exe (%systemroot%\System32\Vmsp.exe)

    Starting with Windows Server 2016, this file may have to be configured as a process exclusion within the antivirus software.

  • Vmcompute.exe (%systemroot%\System32\Vmcompute.exe)

    Note

    Starting with Windows Server 2019