Review and manage Microsoft Defender exclusions on Windows
List what Defender never scans with Get-MpPreference, and add or remove exclusions with Add-MpPreference / Remove-MpPreference.
Run Get-MpPreference | Select-Object -ExpandProperty ExclusionPath to review current path exclusions before adding or removing any.
01Command
Command
$ Get-MpPreference | Select-Object -ExpandProperty ExclusionPath02What it does
Exclusions are a security posture decision hiding in an antivirus preference: anything excluded is invisible to real-time protection, and malware deliberately drops into excluded paths. ExclusionProcess differs subtly from ExclusionPath — it excludes files opened by that process, wherever they live. Auditing the existing lists first is the step everyone skips, yet it is the fastest way to understand why a scan missed something.
03Risk
!Warning: Every exclusion weakens real-time protection — keep paths narrow (no drive roots), and re-check the list regularly since exclusions persist silently.
04Undo
Undo
$ Remove-MpPreference -ExclusionPath "C:\Dev\build"05Sources
- Get-MpPreference | Microsoft LearnEvidence: Microsoft documents Get-MpPreference as retrieving Defender scanning preferences, including ExclusionPath, ExclusionProcess and ExclusionExtension lists.
- Configure and validate exclusions for Microsoft Defender Antivirus | Microsoft LearnEvidence: Microsoft documents path, process and extension exclusions for Defender Antivirus and warns to use the narrowest scope possible when excluding items.
Last verified: 2026-09-17 · Category: Security & Privacy