Windows 10: Add or Remove Windows Defender Exclusions in Windows 10

Hello Dunge, and welcome to Ten Forums. *Smile

I'm afraid that wildcards are not supported for Windows Defender exclusions.

 

I have couple of folders in my exclusions that I cannot remove. Among them is this weird one:



Since I think they are not supposed to be there (probably some malware doing), I'd like them removed. Any way I can do that?

 

Hello Stevo, *Smile

I don't see anything listed in your screenshot to be removed.

 

That's the weirdest thing - there's a folder without a name and the Remove button is disabled.

Other folders that appear (not added by me) are:
C:\Program Files\Youtube AdBlock
C:\WINDOWS\Temp
\AppData\Local\Temp
\AppData\Local\Google\Chrome\User Data

All with Remove button disabled. And non of them appear in regedit.

 

If they are not listed in the registry, then they are most likely not being excluded.

However, I need to see a screenshot showing them in your Windows Defender exclusions list to help confirm.

 

I used right click -> Scan with Windows Defender and it returned 'Scan completed on 0 items'. Here's a screenshot:

 

The "Some settings are managed by your organization" message in red usually indicates that you have a group policy set that is overriding those settings.

If you have Windows 10 Pro, Enterprise, or Education edition installed, you might double check in the Local Group Policy Editor (gpedit.msc) to see if you have any policies enabled for Windows Defender for this.

Group Policy Editor - Quickly View Enabled Policies in Windows - Windows 7 Help Forums

 

That's it.

Thanks for your help.

 

You're most welcome. *Smile

 

Hi im new here hope that ill get a response ...
I have an exclusion that cant be removed
and i think its a malware cause when i try to install some antivirus like bullgaurd bitdefender etc the application is blocked and i cant install it here the screen shot of the exclusion

 

Hello blokblok, and welcome to Ten Forums. *Smile

Which exclusion are you trying to remove?

What happens when you click on the Remove button? Any error messages, or just nothing?

 

when i click the remove button it just goes back all of the items in the screen shot are the items i want to remove

 

In that case it very well could be malware. It would be best to create a new thread for this in our AntiVirus, Firewalls and System Security forum area for more specialized help.

 

@Brink

An answer to why you might exclude something from Defender scans:

a) Legitimately: Sometimes there are train crashes when Defender examines itself
Therefore, you might temporarily add exceptions to [folders]:
C:\Program Files\Windows Defender
C:\Program Files\Windows Defender Advance Threat Protection
and there may be some other special cases, if you know what you are doing & the risks involved.

b) You are a cunning malware writer, and you want to stop your victims from scanning your evil concoctions.

Even if you employ (a) as a matter of course, it is advisable to check exclusions periodically (in particular after any malware managed to get through)
I suppose it's possible the even the Defender files could be compromised, so from time to time re-enable the scans of Defender itself, and scan them. Just to be on the safe side.
{ Hint: You can set your favourite keys as 'favorites' in regedit, and use them just when you do a full scan }

As for (b), malwares often seek to hide from Defender by registering themselves as exclusions. Naughty malwares!
Often, but not always malwares have rather silly codified names, but sometimes the hide in plain sight as reasonable-looking things like "MySafetyScan" (please don't sue me!).

Third-party scanners, trustworthy online scanners, are less easily fooled. But do be careful to avoid fake scanners that just bring more malwares! { I currently use freewares ESET online, Emsisoft, Malwarebytes etc - your mileage may vary. And use adware scanners. }

There are two distinct ways in which Defender exclusions (files or folders) are registered:
1) as direct Defender exclusions
2) as 'Policy' exclusions (security, management)

Both can be solved with regedit, the registry editor (be careful !! - it's a good plan to back up the registry before proceeding !!).
{You will already know to [winkey], enter "regedit", etc, and to install regedit if you don't have it}

The former (1) are likely to be found in this registry key { burrow down carefully, checking for accuracy as you go! }

You will see the Defender settings exclusions there (the ones you see by going to Defender settings, exclusions).

If they look like/are malware, you can delete the entries, all except '(default)'. Be careful, double check !!
{Tip: you can use the standard ctrl-click to select one, & shift-click to select a range) Be careful, double check !! }

The latter (2) are more puzzling, since the Defender settings will not let you remove them.
You will see a message in RED: Some settings are managed by your organization

Musfiquer Rhman at https://answers.microsoft.com/en-us/...f-d6b1b7e1c256 solved this by

That's this key:

A little deeper, I see that some policy keys use "policy objects" (long dll codes in curly brackets), and it may be advisable to drill down into these to make sure they are legitimate. I haven't done so yet.
These keys, the list may not be complete:

When you're done, close regedit & reboot, then double-check everything again. And, of course, get Defender updates & run a scan.

 

Sorry! Missed the link for the Ethernet guide from your previous post *Smile
Already tried the first option, which did not work *Sad
Will try the second option also (as soon as I get a chance to restart my computer *Biggrin)
Thanks!

However, I'd still prefer to go by the firewall approach if possible, because that would ensure that I would never encounter an unexpected Defender data fetch, even when I have connected to a completely new (not-yet-marked-as-metered) wireless/wired network *Smile