Over the past few months we’ve reviewed dozens of Microsoft Defender configurations, and one theme keeps coming up: overuse of exclusions. Folders, file types, even processes that should never be excluded.
There are legitimate reasons to define exclusions (performance, false positives, compatibility), but they need care. Every exclusion = less visibility. Every exclusion = more risk.
Microsoft published a very useful guide, Common mistakes to avoid when defining exclusions, and it’s a must-read. Here’s a practical summary, plus a few insights from the field.
1Excluding “trusted” items
Just because a file or folder looks safe doesn’t mean it should be excluded. Malware often hides in familiar places and mimics legitimate names.
Avoid excluding these folders (Windows):
- %systemdrive%, C:\, C:\Temp\, %Windir%\Temp
- %ProgramFiles%\Java, %ProgramFiles%\Contoso\
- C:\Users\, C:\Users\<User>\AppData\Local\Temp\
- C:\Windows\Prefetch, C:\Windows\System32\Spool, CatRoot2
Avoid excluding these folders (macOS/Linux): /, /bin, /sbin, /usr/lib
2File extensions you should not exclude
Attackers use well-known extensions to drop payloads or run scripts. Yet we often find exclusions for entire file types such as .exe or .dll.
Don’t exclude these extensions: .7z, .bat, .bin, .cab, .cmd, .com, .cpl, .dll, .exe, .fla, .gif, .gz, .hta, .inf, .java, .jar, .job, .jpeg, .jpg, .js, .ko, .msi, .ocx, .png, .ps1, .py, .rar, .reg, .scr, .sys, .tar, .tmp, .url, .vbe, .vbs, .wsf, .zip
If you must exclude something like .gif or .jpg, make sure that:
- Your environment enforces a strict patch and update policy.
- The exclusion is scoped to a specific location or process, not system-wide.
3High-risk processes you should never exclude
Excluding processes is risky business. These processes are often abused in attacks and shouldn’t be excluded under any circumstances.
Windows: powershell.exe, cmd.exe, cscript.exe, wscript.exe, java.exe, mshta.exe, dotnet.exe, outlook.exe, excel.exe, winword.exe, schtasks.exe, svchost.exe, psexec.exe, wmic.exe, dbgsvc.exe, msbuild.exe, AcroRd32.exe and more.
macOS/Linux: bash, sh, zsh, python, python3, java
Even processes like iexplore.exe or fsi.exe can be weaponized.
4Using the file name only, without the full path
We’ve seen environments where files are excluded by name only, such as scan.exe. That’s a bad idea, because malware can use the same file name and land in a different location.
Best practice: always use the fully qualified path, for example C:\Program Files\Contoso\scan.exe, not just scan.exe.
5One list for every workload
You wouldn’t apply the same security policy to a domain controller and a file server, so don’t use one giant exclusion list either. Split exclusions by server role: IIS, SQL Server, SharePoint and RDS have different needs and different exclusions.
6Misusing environment variables as wildcards
This is a classic mistake. Defender Antivirus runs in system context, so it can only resolve system-level variables, not user variables.
- %UserProfile% won’t work.
- %ProgramFiles% and %SystemRoot% are fine.
Avoid user environment variables in exclusions unless you really understand the runtime context.
Before you add an exclusion
Exclusions can be necessary, but they’re also dangerous. Every time you exclude a folder, process or file type, you may be giving attackers a safe zone. Before you add one, ask:
- Is this exclusion really needed?
- Can we scope it more narrowly?
- Is there another workaround that doesn’t reduce protection?
Exclusions are just one of the security settings that drift over time. Griffin31 checks your tenant’s settings continuously and shows you what to fix first.