Microsoft Defender Exclusions

Paths, extensions and processes Microsoft Defender Antivirus is told to skip.

Use it to check what Defender skips, and spot an exclusion added to keep files from being scanned.

SOFTWARE
Defence Evasion

What It Is

Exclusions tell Microsoft Defender Antivirus which files, folders, file extensions and processes to skip when it scans, and a process exclusion skips every file that process opens. Administrators add them to solve a specific problem, such as slow performance or an application that does not work while it is scanned. Microsoft calls each exclusion a protection gap and advises using them sparingly. This key, in the SOFTWARE hive, holds the exclusions set on the machine itself, and those set by policy sit under the Policies key.

What It Proves

A value here names a path, extension or process that scans ignore. A new exclusion for a user-writable folder or a script host turns that location into a scanning blind spot.

What It Does Not Prove

An exclusion does not prove anything ran. It shows only what would not be scanned. Many exclusions are legitimate and set by administrators or software. From platform version 4.18.25110.6 (February 2026), where Defender for Endpoint manages the settings, Microsoft says the exclusion values can no longer be read from the local Registry. An empty key there does not prove there are none.

Where It Lives

Microsoft Defender Exclusions lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

SOFTWARE\Microsoft\Windows Defender\Exclusions

C:\Windows\System32\config\SOFTWARE

What It Looks Like

These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in Microsoft Defender Exclusions, each with what it tells you
Registry Value	What It Tells You
`Paths\C:\Windows\Temp` `REG_DWORD0x00000000 (0)`	C:\Windows\Temp is excluded from scanning, the folder the service binary updsvc64.exe was later dropped into. Remove the exclusion and scan the folder.
`Paths` `SubkeyLast write 12 Oct 2026 10:04 UTC`	The path exclusions last changed at 12 Oct 2026 10:04 UTC, two minutes before the Temp binary. Match it to Defender event 5007 and what ran just before.
`Processes\powershell.exe` `REG_DWORD0x00000000 (0)`	Scans skip every file that powershell.exe opens. A script host is rarely a legitimate exclusion, so date it with event 5007 in the Microsoft-Windows-Windows Defender/Operational log and review PowerShell activity.

How to Read It

Read the Paths, Extensions and Processes subkeys. Policy-set ones sit under Policies\Microsoft\Windows Defender\Exclusions. Compare the list with your approved baseline and investigate any path in Temp, AppData, ProgramData or a user profile. To put it right, remove the unexpected value, rescan that location, and keep exclusions to a reviewed minimum.

When Windows Writes It: When an administrator, Group Policy, or an attacker with admin rights adds or removes an exclusion.
Which Windows Versions: Windows 10, 11 and Server with Microsoft Defender Antivirus
Tools That Parse It: Registry Explorer, RECmd, Get-MpPreference (live)

Hunt It

Sees It DirectlyDeviceRegistryEvents

Defender records these writes inside retention, but the Defender service makes them, so the process shown is MsMpEng.exe, not the requester. Look for the tool that ran just before. Exclusions set before retention only show in the key.

KQLDefender XDR, Advanced hunting

// Exclusions added to Microsoft Defender AntivirusDeviceRegistryEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where RegistryKey contains @"\Windows Defender\Exclusions"| project Timestamp, ActionType, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessCommandLine| order by Timestamp desc

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Microsoft Defender Exclusions shows.

Run and RunOnce KeysShows whether a program set to run at logon sits in the excluded folder.
Defender Setting Changed, Microsoft Defender Event 5007Not in the RegistryDates when the exclusion was added, with the value it set.
Tamper Protection Blocked a Change, Microsoft Defender Event 5013Not in the RegistryShows tamper protection blocked a change, so an exclusion may never have applied.

Sources

The facts on this page come from these public pages, which say more on each point.