Common mistakes to avoid when defining exclusions - Microsoft Defender for Endpoint (2024)

Applies to:

• Microsoft Defender for Endpoint Plan 1
• Microsoft Defender for Endpoint Plan 2
• Microsoft Defender for Endpoint Plan 1
• Microsoft Defender Antivirus

Platforms

• Windows
• macOS
• Linux

You can define an exclusion list for items that you don't want Microsoft Defender Antivirus to scan. However, excluded items could contain threats that make your device vulnerable. This article describes some common mistakes that you should avoid when defining exclusions.

Excluding certain trusted items

Certain files, file types, folders, or processes shouldn't be excluded from scanning even though you trust that they're not malicious. Don't define exclusions for the folder locations, file extensions, and processes that are listed in the following sections:

• Folder locations
• File extensions
• Processes

Folder locations

In general, don't define exclusions for any of the following folder locations:

• %systemdrive%
• C:, C:\, or C:\*
• %ProgramFiles%\Java or C:\Program Files\Java
• %ProgramFiles%\Contoso\, C:\Program Files\Contoso\, %ProgramFiles(x86)%\Contoso\, or C:\Program Files (x86)\Contoso\
• C:\Temp, C:\Temp\, or C:\Temp\*
• C:\Users\ or C:\Users\*
• C:\Users\<UserProfileName>\AppData\Local\Temp\ or C:\Users\<UserProfileName>\AppData\LocalLow\Temp\. Note the following important exceptions for SharePoint: Do exclude C:\Users\ServiceAccount\AppData\Local\Temp or C:\Users\Default\AppData\Local\Temp when you use file-level antivirus protection in SharePoint.
• %Windir%\Prefetch, C:\Windows\Prefetch, C:\Windows\Prefetch\, or C:\Windows\Prefetch\*
• %Windir%\System32\Spool or C:\Windows\System32\Spool
• C:\Windows\System32\CatRoot2
• %Windir%\Temp, C:\Windows\Temp, C:\Windows\Temp\, or C:\Windows\Temp\*

Linux and macOS Platforms

In general, don't define exclusions for the following folder locations:

• /
• /bin or /sbin
• /usr/lib

File extensions

In general, don't define exclusions for the following file extensions:

• .7z
• .bat
• .bin
• .cab
• .cmd
• .com
• .cpl
• .dll
• .exe
• .fla
• .gif
• .gz
• .hta
• .inf
• .java
• .jar
• .job
• .jpeg
• .jpg
• .js
• .ko or .ko.gz
• .msi
• .ocx
• .png
• .ps1
• .py
• .rar
• .reg
• .scr
• .sys
• .tar
• .tmp
• .url
• .vbe
• .vbs
• .wsf
• .zip

Processes

In general, don't define exclusions for the following processes:

• AcroRd32.exe
• addinprocess.exe
• addinprocess32.exe
• addinutil.exe
• bash.exe
• bginfo.exe
• bitsadmin.exe
• cdb.exe
• csi.exe
• cmd.exe
• cscript.exe
• dbghost.exe
• dbgsvc.exe
• dnx.exe
• dotnet.exe
• excel.exe
• fsi.exe
• fsiAnyCpu.exe
• iexplore.exe
• java.exe
• kd.exe
• lxssmanager.dll
• msbuild.exe
• mshta.exe
• ntkd.exe
• ntsd.exe
• outlook.exe
• psexec.exe
• powerpnt.exe
• powershell.exe
• rcsi.exe
• svchost.exe
• schtasks.exe
• system.management.automation.dll
• windbg.exe
• winword.exe
• wmic.exe
• wscript.exe
• wuauclt.exe

Linux and macOS Platforms

In general, don't define exclusions for the following processes:

• bash
• java
• python and python3
• sh
• zsh

Using just the file name in the exclusion list

Malware might have the same name as that of a file that you trust and want to exclude from scanning. Therefore, to avoid excluding potential malware from scanning, use a fully qualified path to the file that you want to exclude instead of using just the file name. For example, if you want to exclude Filename.exe from scanning, use the complete path to the file, such as C:\program files\contoso\Filename.exe.

Using a single exclusion list for multiple server workloads

Don't use a single exclusion list to define exclusions for multiple server workloads. Split the exclusions for different application or service workloads into multiple exclusion lists. For example, the exclusion list for your IIS Server workload must be different from the exclusion list for your SQL Server workload.

Using incorrect environment variables as wildcards in the file name and folder path or extension exclusion lists

Microsoft Defender Antivirus Service runs in system context using the LocalSystem account, which means it gets information from the system environment variable, and not from the user environment variable. Use of environment variables as a wildcard in exclusion lists is limited to system variables and those applicable to processes running as an NT AUTHORITY\SYSTEM account. Therefore, don't use user environment variables as wildcards when adding Microsoft Defender Antivirus folder and process exclusions. See the table under System environment variables for a complete list of system environment variables.

See Use wildcards in the file name and folder path or extension exclusion lists for information on how to use wildcards in exclusion lists.

See also

• Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus
• Configure custom exclusions for Microsoft Defender Antivirus
• Configure and validate exclusions for Microsoft Defender for Endpoint on Linux
• Configure and validate exclusions for Microsoft Defender for Endpoint on macOS