Windows Defender Exclusions: How to Add Files, Folders and Processes
How to add exclusions in Windows Defender on Windows 10 and 11 via Settings, PowerShell and Group Policy. Exclude folders, file types, processes and IP addresses.
Sometimes legitimate apps trigger false positives in Windows Defender. Adding exclusions lets those apps run without disabling protection entirely.
View Current Exclusions
$prefs = Get-MpPreference
Write-Host "Folders:" ; $prefs.ExclusionPath
Write-Host "Files:" ; $prefs.ExclusionIpAddress
Write-Host "Extensions:" ; $prefs.ExclusionExtension
Write-Host "Processes:" ; $prefs.ExclusionProcess
Add Exclusions
# Exclude a folder (and all subfolders)
Add-MpPreference -ExclusionPath "C:\DevTools"
Add-MpPreference -ExclusionPath "D:\VMs"
# Exclude a specific file
Add-MpPreference -ExclusionPath "C:\Tools\nmap.exe"
# Exclude by process (any file that process opens)
Add-MpPreference -ExclusionProcess "python.exe"
Add-MpPreference -ExclusionProcess "node.exe"
# Exclude by extension
Add-MpPreference -ExclusionExtension ".log"
Add-MpPreference -ExclusionExtension ".tmp"
Remove Exclusions
Remove-MpPreference -ExclusionPath "C:\DevTools"
Remove-MpPreference -ExclusionProcess "python.exe"
Remove-MpPreference -ExclusionExtension ".log"
Configure via Group Policy
gpedit.msc → Computer Configuration → Administrative Templates → Windows Components → Microsoft Defender Antivirus → Exclusions
- Path Exclusions — folders and files
- Process Exclusions — by executable name
- Extension Exclusions — by file extension
Best Practices
# Audit exclusions — list all with date added (via registry)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" -EA 0
# Never exclude:
# - C:\Windows\System32 or entire C:\Windows
# - %TEMP% or %APPDATA% — high-risk malware locations
# - Browser download folders
# Safe to exclude:
# - Specific dev tool folders (C:\Python, C:\nodejs)
# - Build output folders (bin\, obj\, dist\)
# - VM disk files (*.vmdk, *.vhdx) on non-system drives
Summary
Use Add-MpPreference for targeted exclusions. Prefer process exclusions over folder exclusions. Never exclude system folders or temp directories. Review exclusions monthly — remove any that are no longer needed.
Frequently Asked Questions
Does adding an exclusion make my PC less secure?
Yes, for that specific path or process. Malware that lands in an excluded folder won't be scanned. Keep exclusions minimal and specific — a single executable is safer than an entire folder.
Windows Defender keeps re-detecting a file I've excluded — why?
The file might be in a different location than your exclusion path. Check the exact path in the Defender notification. Also verify the exclusion was saved: (Get-MpPreference).ExclusionPath.
Can I export exclusions for use on other PCs?
# Export
Get-MpPreference | Select-Object Exclusion* | Export-Csv "exclusions.csv"
# Apply on another PC via GPO or script