Common mistakes to avoid when defining exclusions (Microsoft)

Before defining your exclusion lists, see Recommendations for defining exclusions.

Excluding certain trusted items

Certain files, file types, folders, or processes should not be excluded from scanning even though you trust them to be not malicious.

Do not define exclusions for the folder locations, file extensions, and processes that are listed in the following sections:

• Folder locations
• File extensions
• Processes

Folder locations

In general, do not define exclusions for the following folder locations:

%systemdrive%

C:

C:\

C:\*

%ProgramFiles%\Java

C:\Program Files\Java

%ProgramFiles%\Contoso\

C:\Program Files\Contoso\

%ProgramFiles(x86)%\Contoso\

C:\Program Files (x86)\Contoso\

C:\Temp

C:\Temp\

C:\Temp\*

C:\Users\

C:\Users\*

C:\Users\<UserProfileName>\AppData\Local\Temp\ Note the following exception for SharePoint: Do exclude C:\Users\ServiceAccount\AppData\Local\Temp when you use file-level antivirus protection in SharePoint.

C:\Users\<UserProfileName>\AppData\LocalLow\Temp\ Note the following exception for SharePoint: Do exclude C:\Users\Default\AppData\Local\Temp when you use file-level antivirus protection in SharePoint.

%Windir%\Prefetch

C:\Windows\Prefetch

C:\Windows\Prefetch\

C:\Windows\Prefetch\*

%Windir%\System32\Spool

C:\Windows\System32\Spool

C:\Windows\System32\CatRoot2 %Windir%\Temp

C:\Windows\Temp

C:\Windows\Temp\

C:\Windows\Temp\*

Linux and macOS Platforms

/

/bin

/sbin

/usr/lib

File extensions

In general, do not define exclusions for the following file extensions:

.7z

.bat

.bin

.cab

.cmd

.com

.cpl

.dll

.exe

.fla

.gif

.gz

.hta

.inf

.java

.jar

.job

.jpeg

.jpg

.js

.ko

.ko.gz

.msi

.ocx

.png

.ps1

.py

.rar

.reg

.scr

.sys

.tar

.tmp

.url

.vbe

.vbs

.wsf

.zip

Processes

In general, do not define exclusions for the following processes:

AcroRd32.exe

bitsadmin.exe

excel.exe

iexplore.exe

java.exe

outlook.exe

psexec.exe

powerpnt.exe

powershell.exe

schtasks.exe

svchost.exe

wmic.exe

winword.exe

wuauclt.exe

addinprocess.exe

addinprocess32.exe

addinutil.exe

bash.exe

bginfo.exe

cdb.exe

csi.exe

dbghost.exe

dbgsvc.exe

dnx.exe

dotnet.exe

fsi.exe

fsiAnyCpu.exe

kd.exe

ntkd.exe

lxssmanager.dll

msbuild.exe

mshta.exe

ntsd.exe

rcsi.exe

system.management.automation.dll

windbg.exe

Linux and macOS Platforms

bash

sh

python and python3

java

zsh

Using just the file name in the exclusion list

Malware might have the same name as that of a file that you trust and want to exclude from scanning. Therefore, to avoid excluding potential malware from scanning, use a fully qualified path to the file that you want to exclude instead of using just the file name. For example, if you want to exclude Filename.exe from scanning, use the complete path to the file, such as C:\program files\contoso\Filename.exe.

Using a single exclusion list for multiple server workloads

Do not use a single exclusion list to define exclusions for multiple server workloads. Split the exclusions for different application or service workloads into multiple exclusion lists. For example, the exclusion list for your IIS Server workload must be different from the exclusion list for your SQL Server workload.

Using incorrect environment variables as wildcards in the file name and folder path or extension exclusion lists

Microsoft Defender Antivirus Service runs in system context using the LocalSystem account, which means it gets information from the system environment variable, and not from the user environment variable. Use of environment variables as a wildcard in exclusion lists is limited to system variables and those applicable to processes running as an NT AUTHORITY\SYSTEM account. Therefore, do not use user environment variables as wildcards when adding Microsoft Defender Antivirus folder and process exclusions. See the table under System environment variables for a complete list of system environment variables.

See Use wildcards in the file name and folder path or extension exclusion lists for information on how to use wildcards in exclusion lists.