Microsoft Defender: manage antivirus exclusions without weakening security

An exclusion is security debt, not a performance setting

A Microsoft Defender exclusion tells the engine not to inspect a specific part of activity. It can resolve a genuine conflict or measured overhead, but it also creates a place where an attacker may store, modify, or run content with fewer controls. A recommendation copied from an old guide is not enough: prove the problem, select the narrowest mechanism, and plan its removal.

The word exclusion covers several different controls. An antivirus exclusion is not an EDR exclusion; an ASR exclusion does not necessarily disable antivirus scanning; an Allow indicator is a broader trust decision. Confusing them either leaves the outage unresolved or creates a much larger blind spot than intended.

1. Start with evidence and ownership

For performance issues, start with Defender's performance analyzer. It ranks paths, files, extensions, and processes consuming scan time during a reproduction. A high-ranking item is a hypothesis to validate, not automatic approval for an exclusion.

• Describe the exact symptom: blocked file, ASR event, measured delay, application error, or current vendor requirement.
• Identify business and technical owners, targeted devices, product version, and actual path.
• Keep the link to current vendor documentation and confirm it matches the deployed release.
• Measure before and after on a pilot ring; an assumed improvement is not justification.
• Set an expiry or review date, removal criterion, and rollback path.
• Reject vague requests to exclude an application folder without a specific file, process, workload, and risk.

• Microsoft — Performance analyzer for Defender Antivirus ↗
• Article — Diagnose a slow file server →

2. Inventory protection and visible exclusions

Collect state from a representative device for each policy. Get-MpPreference returns visible custom exclusions and ASR configuration; Get-MpComputerStatus confirms antivirus mode, real-time protection, and engine versions. When HideExclusionsFromLocalAdmins is enabled, lists can intentionally be hidden from local administrators, so empty output does not prove that no exclusion exists.

Built-in operating-system exclusions and automatic Windows Server role exclusions do not appear in standard lists. Compare central policy, effective behavior, and installed roles instead of expecting one perfect source.

$Status = Get-MpComputerStatus
$Pref = Get-MpPreference

$Status | Select-Object AMRunningMode,AntivirusEnabled,RealTimeProtectionEnabled,BehaviorMonitorEnabled,IoavProtectionEnabled,AntivirusSignatureVersion,AMProductVersion

'ExclusionPath','ExclusionProcess','ExclusionExtension','AttackSurfaceReductionOnlyExclusions' |
  ForEach-Object {
    $Type = $_
    @($Pref.$Type) | ForEach-Object {
      [pscustomobject]@{ Type = $Type; Value = $_ }
    }
  } | Format-Table -AutoSize

$Pref.AttackSurfaceReductionRules_Ids
$Pref.AttackSurfaceReductionRules_Actions

• Microsoft — Exclusions in Defender Antivirus ↗
• Microsoft — Protect and hide exclusions from local administrators ↗

3. Choose the narrowest antivirus scope

A fully qualified file exclusion is generally narrower than a folder, and a folder is narrower than a global extension. A folder also excludes its files and subfolders, subject to reparse-point details. An extension such as .dll or .exe applies everywhere on the device and creates a difficult surface to defend.

Environment variables resolve in the LocalSystem context. For example, %TEMP% does not necessarily mean the user's profile. Wildcards also have specific semantics; test the effective path instead of assuming an expression covers only the intended folder.

• Microsoft — Exclusions to avoid ↗

4. Understand the process-exclusion trap

ExclusionProcess does not mean 'do not scan this EXE.' It tells Defender Antivirus to skip files opened by the named process. Excluding the executable itself would require a separate path exclusion. A name such as app.exe matches that process name regardless of location; use the full path whenever possible.

The scope extends beyond antivirus. Microsoft states that process exclusions prevent Network Protection and ASR rules from inspecting traffic or enforcing rules for that process. Excluding powershell.exe, outlook.exe, winword.exe, java.exe, or a general interpreter can therefore remove several useful barriers.

• Validate the path, digital signature, and hash of the tested release.
• Identify which files the process actually opens; prefer a data-file exclusion if it is sufficient.
• Avoid interpreters, browsers, Office applications, and general administration tools.
• Retest after every application update because the binary, path, or behavior can change.

$File = 'C:\Program Files\Contoso\Agent\agent.exe'
Get-Item $File | Select-Object FullName,Length,CreationTimeUtc,LastWriteTimeUtc
Get-AuthenticodeSignature $File | Select-Object Status,StatusMessage,SignerCertificate
Get-FileHash $File -Algorithm SHA256

5. Do not recreate exclusions Windows Server already applies

On Windows Server 2016 and later, Defender Antivirus automatically applies exclusions for installed roles and built-in exclusions for certain operating-system files. They are delivered and maintained through security intelligence and do not appear in the standard list. Windows Server 2012 R2 with the modern unified solution does not receive the same automatic role exclusions.

A custom list copied to every server can duplicate native behavior, remain after a role is removed, and expose unused paths. Separate SQL, IIS, file-server, domain-controller, and specialized-application policies; do not use one universal server list.

• Microsoft — Defender Antivirus exclusions on Windows Server ↗

6. Separate ASR exclusions from antivirus exclusions

An Attack Surface Reduction rule blocks behavior, such as an Office child process or an obfuscated script. If one specific ASR event is a false positive, an ASR exclusion can be more appropriate than an antivirus exclusion. A global ASR exclusion applies to compatible rules; a per-rule exclusion limits the protection reduction when the platform and management method support it.

Some rules have limited exclusion support. Begin in Audit or Warn, inspect DeviceEvents, and then allow only the justified file or path. Do not use an antivirus process exclusion to bypass an ASR block: it can disable ASR and Network Protection inspection far more broadly.

• Article — Deploy ASR rules from Audit to Block →
• Microsoft — ASR rule reference and exclusion limits ↗
• Microsoft — Configure ASR rules and exclusions ↗

7. Understand what EDR can still see

A Defender Antivirus exclusion does not automatically remove all Defender for Endpoint visibility. Microsoft states that excluded files can still raise EDR alerts or behavioral and heuristic detections in the portal. That is desirable: a compatibility exception should not become total invisibility.

EDR in block mode is a different feature. It lets Defender for Endpoint remediate certain behavioral artifacts when Defender Antivirus is passive behind a third-party antivirus product. It does not restore real-time protection, ASR rules, Network Protection, or indicators that require active Defender Antivirus. Do not treat it as automatic compensation for an exclusion or passive mode.

• Microsoft — EDR in block mode ↗

8. Reserve Allow indicators for truly targeted exceptions

Microsoft Defender for Endpoint indicators can allow, audit, warn, or block a file, certificate, IP address, or URL depending on type. A file Allow indicator affects the prevention engine and automated investigation, so its scope is broader than a scan exclusion. Use it only when the object is stable and the desired outcome genuinely matches that verdict.

A file hash changes with each release. A certificate can cover multiple files signed by the same publisher. To allow a whole application, Microsoft recommends an application-control policy such as WDAC or AppLocker instead of a collection of hashes. Every indicator needs a device-group scope, description, and expiry.

• Microsoft — Overview of indicators ↗
• Microsoft — Create a file indicator ↗

9. Deploy centrally without creating an uncontrolled superset

Microsoft recommends Intune or another enterprise management method for exclusion deployment. A dedicated antivirus-exclusions profile improves ownership and removal, but Intune merges exclusions from all assigned policies into one superset on the device. Two narrow profiles can therefore create unexpected combined scope when their assignments overlap.

With Group Policy, use Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Exclusions. Avoid mixing Intune, Configuration Manager, GPO, startup scripts, and local changes without defining the authority. Tamper Protection and local-list merge behavior must support that model.

The code below illustrates Add/Remove semantics for a local pilot. In production, record the value in central policy so it is reproducible. Set-MpPreference can overwrite the current list for the targeted parameter; do not use it to blindly append one entry.

$Path = 'D:\ContosoData\Queue\*.tmp'

# Add preserves other values; Set would replace the complete list for this type.
Add-MpPreference -ExclusionPath $Path

# After validation or at expiry:
Remove-MpPreference -ExclusionPath $Path

• Microsoft — Configure custom exclusions ↗

10. Validate both the effect and remaining protection

MpCmdRun -CheckExclusion confirms whether a path is effectively excluded, including inheritance from a parent folder. It does not identify which matching policy won. Also retest the application scenario, performance, and the controls that are expected to remain active.

An EICAR file can validate a file, folder, or extension exclusion in an isolated test environment. It does not validate a process exclusion. Do not move that test through production workflows, and remove the artifacts through the normal security procedure.

• The application works and the targeted metric improves reproducibly.
• Other product paths remain scanned.
• Expected ASR, Network Protection, and EDR telemetry is still present.
• Removing the exception restores protection without an orphaned policy.
• The next application update triggers revalidation rather than automatic renewal.

cd /d "%ProgramData%\Microsoft\Windows Defender\Platform"
dir /ad /b /o:-n

rem Enter the newest platform folder, then run:
MpCmdRun.exe -CheckExclusion -Path "D:\ContosoData\Queue\sample.tmp"

Minimum governance register

Decision checklist

• Is the problem reproduced and attributed to Defender rather than the app, network, or storage?
• Can an update, vendor configuration, or automatic exclusion remove the need?
• Can you target a file instead of a folder, a folder instead of an extension, or one ASR rule instead of a process?
• Are the full path, signature, hash, version, and device group documented?
• Does the exclusion also weaken ASR, Network Protection, indicators, or automated remediation?
• Do path and service permissions prevent an unprivileged user from placing content there?
• Are owner, expiry, validation, and removal recorded?
• Do untargeted devices remain protected, and are pilot outcomes monitored?

Shrink the exception instead of normalizing risk

A good exclusion solves one problem on few devices for a known duration, with measurable compensating controls. A bad exclusion is broad, permanent, ownerless, and copied into every profile. The difference is as much governance as PowerShell or Intune.

In a complex environment, a review must connect effective exclusions, server roles, ASR rules, indicators, application versions, folder permissions, and incidents. This guide structures the decision; it does not replace a complete Microsoft Defender posture assessment.

• Service — Cybersecurity and Microsoft Defender consulting →
• Service — Microsoft 365 and Entra ID security assessment →