Defender exclusions: a checklist before you exclude a dev folder

Microsoft says you usually do not need to define exclusions for Microsoft Defender Antivirus. If a build is slow enough that you want one, choose the narrowest exclusion type, manage it centrally, protect it from tampering, and test it with the EICAR file so you know what you actually excluded.

The three kinds of exclusion

Microsoft documents file and folder exclusions, process exclusions, and contextual exclusions.

• File and folder exclusions skip the listed path, and a folder exclusion covers everything under it. Extension exclusions skip any file with that extension, anywhere.
• Process exclusions skip files opened by the named process. The process itself is not excluded. To exclude the executable, you add a path exclusion for it.
• Contextual exclusions limit an exclusion to a situation, for example only during on-demand scans.

Custom exclusions apply to scheduled scans, on-demand scans and real-time protection. Process exclusions are the exception: they apply to real-time protection only.

Checklist before you add one

1. Measure first. Is Defender really the slow part? Time the build with and without it on a test machine.
2. Prefer a path exclusion for a specific build output folder over an extension exclusion. An extension exclusion for something like .dll or .js is far too broad.
3. Avoid excluding a folder where people download or unpack files, such as the user download folder.
4. Do not exclude a process that can run arbitrary content, such as an interpreter. Anything it opens would go unscanned.
5. Consider a contextual exclusion that applies only to on-demand scans, if that is where the cost is.
6. Write down the owner, the reason and a review date.

Windows 11 also has a developer volume feature with a performance mode for antivirus. Our post on the Dev Drive tradeoff covers that route: /resources/blog/dev-drive-defender-performance-mode-tradeoff.

Manage them centrally

Microsoft recommends enterprise tools such as Intune or Configuration Manager for managing exclusions, and notes that settings from those overwrite conflicting Group Policy or PowerShell settings at startup. Group Policy also works, under Computer configuration, Administrative templates, Windows components, Microsoft Defender Antivirus, Exclusions.

For a single device, the Windows Security app lets you add one, but changes made there do not appear in Group Policy exclusions.

To list what is set on a machine, read the preferences with Get-MpPreference. To add one:

Add-MpPreference -ExclusionPath "C:\src\build-output"

Set-MpPreference overwrites existing exclusions of that type, so use Add-MpPreference unless you mean to replace the list.

Protect and hide them

Attackers like exclusions. A folder that is never scanned is a convenient place to drop a tool. Microsoft describes ways to protect them: tamper protection can protect exclusions, and settings exist to hide exclusion lists from local administrators and local users. Hiding does not remove existing exclusions, and they stop appearing in Get-MpPreference and the registry.

Test the exclusion

Microsoft suggests the EICAR test file, a harmless text file containing a standard string every antivirus detects. Create it so its name, extension or location matches the exclusion. If Defender does not detect it, the exclusion works. If it does detect it, the exclusion does not. This method does not validate process exclusions.

There is also a command line check, MpCmdRun.exe with the CheckExclusion option and a path. A folder exclusion makes everything below it report as excluded, so the check tells you whether a path is excluded, not which entry matched.

Review them on a schedule

Quarterly, list every exclusion on a sample of developer machines and ask whether the reason still holds. Exclusions for tools that were retired are free attack surface.

Quick check

Sources

• Configure custom exclusions for Microsoft Defender Antivirus, Microsoft Learn

Last reviewed: 19 October 2026.