Exclusions are the difference between a build that takes two minutes and one that takes twenty. They are also the setting most often configured on the wrong path — and quietly ignored.
Add the folder with **Add-MpPreference -ExclusionPath**, read it back with **Get-MpPreference** and confirm the effective policy. Managed machines override local exclusions silently.
**Get-MpPreference** lists paths, processes and extensions. Starting from the current list prevents duplicates and shows whether a previous admin already covered the folder.
Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
Get-MpPreference | Select-Object -ExpandProperty ExclusionProcess
Get-MpPreference | Select-Object -ExpandProperty ExclusionExtensionA folder is broader than a process and a process is broader than a file extension. Exclude the build output folder first, and add a process only when the folder is not enough.
Add-MpPreference -ExclusionPath 'D:\Build\obj','D:\Build\bin'
Add-MpPreference -ExclusionProcess 'msbuild.exe','cl.exe'
Get-MpPreference | Select-Object -ExpandProperty ExclusionPathOn a managed machine the values from Group Policy or Intune win over local ones. **Get-MpPreference** then shows your addition while the engine ignores it, which is the confusing case.
Get-MpPreference | Select-Object DisableAutoExclusions,ExclusionPath
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /s
Get-MpComputerStatus | Select-Object AntivirusEnabled,RealTimeProtectionEnabled,AMServiceEnabledThe list is only a claim. Run a scan on that exact folder: without the exclusion the files are read and counted, with it they are skipped, which is visible in the scan duration and the file count.
$f = 'D:\Build\obj'
Start-MpScan -ScanType CustomScan -ScanPath $f
Get-MpComputerStatus | Select-Object QuickScanStartTime,FullScanStartTime
Get-WinEvent -LogName 'Microsoft-Windows-Windows Defender/Operational' -MaxEvents 10 | Select-Object TimeCreated,Id,MessageTrailing backslashes, mapped drives and environment variables are the three usual reasons an exclusion does nothing. Defender matches literal paths, so use the drive letter form.
Test-Path 'D:\Build\obj'
(Get-Item 'D:\Build\obj').FullName
Get-MpPreference | Select-Object -ExpandProperty ExclusionPath | ForEach-Object { [pscustomobject]@{ Path = $_; Exists = (Test-Path $_) } }Every exclusion is a gap. Review the list quarterly, remove what a project no longer needs, and record why each entry exists.
Remove-MpPreference -ExclusionPath 'D:\Build\bin'
Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
Get-Content C:\Build\exclusions.txt -ErrorAction SilentlyContinueA policy exclusion list is in force and takes over the whole set. Check the registry path under Policies and the Intune configuration.
The cmdlet needs an elevated session, and Tamper Protection blocks changes on some builds. Check Get-MpComputerStatus for IsTamperProtected.
Defender runs in passive mode and its exclusions do nothing. Configure the equivalent rule in the product that actually scans.
A management tool rewrites them. Add the exclusion at the source instead of fighting it locally.
No. It only removes those files, folders or processes from scanning; everything else stays protected.
No. The change requires elevation and is usually restricted by policy on business machines.
Remove each entry with Remove-MpPreference -ExclusionPath, -ExclusionProcess or -ExclusionExtension, then confirm with Get-MpPreference. Policy-managed exclusions must be removed where they are defined.
Free · no account needed · tracks your progress