Windows Defender Exclusions: How to Add Files, Folders and Processes

4 min readUpdated

How to add exclusions in Windows Defender on Windows 10 and 11 via Settings, PowerShell and Group Policy. Exclude folders, file types, processes and IP addresses.

Share:TelegramX

Sometimes legitimate apps trigger false positives in Windows Defender. Adding exclusions lets those apps run without disabling protection entirely.


View Current Exclusions

$prefs = Get-MpPreference
Write-Host "Folders:"    ; $prefs.ExclusionPath
Write-Host "Files:"      ; $prefs.ExclusionIpAddress
Write-Host "Extensions:" ; $prefs.ExclusionExtension
Write-Host "Processes:"  ; $prefs.ExclusionProcess

Add Exclusions

# Exclude a folder (and all subfolders)
Add-MpPreference -ExclusionPath "C:\DevTools"
Add-MpPreference -ExclusionPath "D:\VMs"

# Exclude a specific file
Add-MpPreference -ExclusionPath "C:\Tools\nmap.exe"

# Exclude by process (any file that process opens)
Add-MpPreference -ExclusionProcess "python.exe"
Add-MpPreference -ExclusionProcess "node.exe"

# Exclude by extension
Add-MpPreference -ExclusionExtension ".log"
Add-MpPreference -ExclusionExtension ".tmp"

Remove Exclusions

Remove-MpPreference -ExclusionPath "C:\DevTools"
Remove-MpPreference -ExclusionProcess "python.exe"
Remove-MpPreference -ExclusionExtension ".log"

Configure via Group Policy

gpedit.mscComputer ConfigurationAdministrative TemplatesWindows ComponentsMicrosoft Defender AntivirusExclusions

  • Path Exclusions — folders and files
  • Process Exclusions — by executable name
  • Extension Exclusions — by file extension

Best Practices

# Audit exclusions — list all with date added (via registry)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" -EA 0

# Never exclude:
# - C:\Windows\System32 or entire C:\Windows
# - %TEMP% or %APPDATA% — high-risk malware locations
# - Browser download folders

# Safe to exclude:
# - Specific dev tool folders (C:\Python, C:\nodejs)
# - Build output folders (bin\, obj\, dist\)
# - VM disk files (*.vmdk, *.vhdx) on non-system drives

Summary

Use Add-MpPreference for targeted exclusions. Prefer process exclusions over folder exclusions. Never exclude system folders or temp directories. Review exclusions monthly — remove any that are no longer needed.

Frequently Asked Questions

Does adding an exclusion make my PC less secure?

Yes, for that specific path or process. Malware that lands in an excluded folder won't be scanned. Keep exclusions minimal and specific — a single executable is safer than an entire folder.

Windows Defender keeps re-detecting a file I've excluded — why?

The file might be in a different location than your exclusion path. Check the exact path in the Defender notification. Also verify the exclusion was saved: (Get-MpPreference).ExclusionPath.

Can I export exclusions for use on other PCs?

# Export
Get-MpPreference | Select-Object Exclusion* | Export-Csv "exclusions.csv"
# Apply on another PC via GPO or script

Related articles

💬 Leave a comment

Comments are moderated before publishing.

← All articles