Configure and validate exclusions based on file extension and folder location (Microsoft)

You can define exclusions for Microsoft Defender Antivirus that apply to scheduled scans, on-demand scans, and always-on, real-time protection and monitoring. Generally, you shouldn’t need to apply exclusions. If you do need to apply exclusions, you can choose from several different kinds:

• Exclusions based on file extensions and folder locations (described in this article)
• Exclusions for files that are opened by processes

Before you begin…

See Recommendations for defining exclusions before defining your exclusion lists.

Exclusion lists

To exclude certain files from Microsoft Defender Antivirus scans, you modify your exclusion lists. Microsoft Defender Antivirus includes many automatic exclusions based on known operating system behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations.

The following table lists some examples of exclusions based on file extension and folder location.

Characteristics of exclusion lists

• Folder exclusions apply to all files and folders under that folder, unless the subfolder is a reparse point. Reparse point subfolders must be excluded separately.
• File extensions apply to any file name with the defined extension if a path or folder is not defined.

Important notes about exclusions based on file extensions and folder locations

• Using wildcards such as the asterisk (*) will alter how the exclusion rules are interpreted. See the Use wildcards in the file name and folder path or extension exclusion lists section for important information about how wildcards work.
• Don’t exclude mapped network drives. Specify the actual network path.
• Folders that are reparse points that are created after the Microsoft Defender Antivirus service starts and that have been added to the exclusion list will not be included. Restart the service (by restarting Windows) for new reparse points to be recognized as a valid exclusion target.
• Exclusions apply to scheduled scans, on-demand scans, and real-time protection, but not across Defender for Endpoint. To define exclusions across Defender for Endpoint, use custom indicators.
• By default, local changes made to the lists (by users with administrator privileges, including changes made with PowerShell and WMI) will be merged with the lists as defined (and deployed) by Group Policy, Configuration Manager, or Intune. The Group Policy lists take precedence when there are conflicts. In addition, exclusion list changes made with Group Policy are visible in the Windows Security app.
• To allow local changes to override managed deployment settings, configure how locally and globally defined exclusions lists are merged.

Configure the list of exclusions based on folder name or file extension

You can choose from several methods to define exclusions for Microsoft Defender Antivirus.

Use Intune to configure file name, folder, or file extension exclusions

See the following articles:

• Configure device restriction settings in Microsoft Intune
• Microsoft Defender Antivirus device restriction settings for Windows 10 in Intune

Use Configuration Manager to configure file name, folder, or file extension exclusions

See How to create and deploy antimalware policies: Exclusion settings for details on configuring Microsoft Endpoint Manager (current branch).

Use Group Policy to configure folder or file extension exclusions

1. On your Group Policy management computer, open the Group Policy Management Console, right-click the Group Policy Object you want to configure and select Edit.
2. In the Group Policy Management Editor go to Computer configuration and select Administrative templates.
3. Expand the tree to Windows components > Microsoft Defender Antivirus > Exclusions.
4. Open the Path Exclusions setting for editing, and add your exclusions.
   1. Set the option to Enabled.
   2. Under the Options section, select Show.
   3. Specify each folder on its own line under the Value name column.
   4. If you are specifying a file, ensure that you enter a fully qualified path to the file, including the drive letter, folder path, file name, and extension.
   5. Enter 0 in the Value column.
5. Choose OK.
6. Open the Extension Exclusions setting for editing and add your exclusions.
   1. Set the option to Enabled.
   2. Under the Options section, select Show.
   3. Enter each file extension on its own line under the Value name column.
   4. Enter 0 in the Value column.
7. Choose OK.

Use PowerShell cmdlets to configure file name, folder, or file extension exclusions

Using PowerShell to add or remove exclusions for files based on the extension, location, or file name requires using a combination of three cmdlets and the appropriate exclusion list parameter. The cmdlets are all in the Defender module.

The format for the cmdlets is as follows:

<cmdlet> -<exclusion list> "<item>"

The following table lists cmdlets that you can use in the <cmdlet> portion of the PowerShell cmdlet:

The following table lists values that you can use in the <exclusion list> portion of the PowerShell cmdlet:

For example, the following code snippet would cause Microsoft Defender Antivirus scans to exclude any file with the .test file extension:

Add-MpPreference -ExclusionExtension ".test"

Use Windows Management Instrumentation (WMI) to configure file name, folder, or file extension exclusions

Use the Set, Add, and Remove methods of the MSFT_MpPreference class for the following properties:

ExclusionExtension
ExclusionPath

Using Set, Add, and Remove is analogous to their counterparts in PowerShell: Set-MpPreference, Add-MpPreference, and Remove-MpPreference.

Use the Windows Security app to configure file name, folder, or file extension exclusions

See Add exclusions in the Windows Security app for instructions.

Use wildcards in the file name and folder path or extension exclusion lists

You can use the asterisk *, question mark ?, or environment variables (such as %ALLUSERSPROFILE%) as wildcards when defining items in the file name or folder path exclusion list. The way in which these wildcards are interpreted differs from their usual usage in other apps and languages. Make sure to read this section to understand their specific limitations.

The following table describes how the wildcards can be used and provides some examples.

System environment variables

The following table lists and describes the system account environment variables.

Review the list of exclusions

You can retrieve the items in the exclusion list using one of the following methods:

• Intune
• Microsoft Endpoint Configuration Manager
• MpCmdRun
• PowerShell
• Windows Security app

If you use PowerShell, you can retrieve the list in two ways:

• Retrieve the status of all Microsoft Defender Antivirus preferences. Each list is displayed on separate lines, but the items within each list are combined into the same line.
• Write the status of all preferences to a variable, and use that variable to only call the specific list you are interested in. Each use of Add-MpPreference is written to a new line.

Validate the exclusion list by using MpCmdRun

To check exclusions with the dedicated command-line tool mpcmdrun.exe, use the following command:

Start, CMD (Run as admin)
cd "%programdata%\microsoft\windows defender\platform"
cd 4.18.2111-5.0 (Where 4.18.2111-5.0 is this month's Microsoft Defender Antivirus "Platform Update".)
MpCmdRun.exe -CheckExclusion -path <path>

Review the list of exclusions alongside all other Microsoft Defender Antivirus preferences by using PowerShell

Use the following cmdlet:

Get-MpPreference

In the following example, the items contained in the ExclusionExtension list are highlighted:

For more information, see Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus and Defender Antivirus cmdlets.

Retrieve a specific exclusions list by using PowerShell

Use the following code snippet (enter each line as a separate command); replace WDAVprefs with whatever label you want to name the variable:

$WDAVprefs = Get-MpPreference
$WDAVprefs.ExclusionExtension
$WDAVprefs.ExclusionPath

In the following example, the list is split into new lines for each use of the Add-MpPreference cmdlet:

For more information, see Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus and Defender Antivirus cmdlets.

Validate exclusions lists with the EICAR test file

You can validate that your exclusion lists are working by using PowerShell with either the Invoke-WebRequest cmdlet or the .NET WebClient class to download a test file.

In the following PowerShell snippet, replace test.txt with a file that conforms to your exclusion rules. For example, if you have excluded the .testing extension, replace test.txt with test.testing. If you are testing a path, ensure you run the cmdlet within that path.

Invoke-WebRequest "http://www.eicar.org/download/eicar.com.txt" -OutFile "test.txt"

If Microsoft Defender Antivirus reports malware, then the rule is not working. If there is no report of malware and the downloaded file exists, then the exclusion is working. You can open the file to confirm the contents are the same as what is described on the EICAR test file website.

You can also use the following PowerShell code, which calls the .NET WebClient class to download the test file – as with the Invoke-WebRequest cmdlet; replace c:\test.txt with a file that conforms to the rule you are validating:

$client = new-object System.Net.WebClient
$client.DownloadFile("http://www.eicar.org/download/eicar.com.txt","c:\test.txt")

If you do not have Internet access, you can create your own EICAR test file by writing the EICAR string to a new text file with the following PowerShell command:

[io.file]::WriteAllText("test.txt",'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*')

You can also copy the string into a blank text file and attempt to save it with the file name or in the folder you are attempting to exclude.

Source : Official Microsoft Brand
Editor by : BEST Antivirus KBS Team