Antimalware Policies folder exclusions and it's subfolder

Thank you, @AllenLiu-MSFT

What is the best way to verify that the the subfolders of E:\X_Folders have been excluded from Defender scanning?

Thank you, @AllenLiu-MSFT

What the best way to verify that the subfolders of E:\X_Folders have been excluded from Defender?

Hi,

To verify that the subfolders of E:\X_Folder have been excluded from Defender, you can use the MpCmdRun command-line tool. First, open an elevated Command Prompt and navigate to the Microsoft Defender Antivirus platform directory by running the following commands:

Start, CMD (Run as admin)
cd "%programdata%\microsoft\windows defender\platform"

Then, run the following command to check if a specific path is excluded:

MpCmdRun.exe -CheckExclusion -path E:\X_Folder\subfolder

Replace "subfolder" with the name of the subfolder you want to check. If the output shows that the path is excluded, then the subfolders of E:\X_Folder have been excluded from Defender.

References:

https://video2.skills-academy.com/en-us/defender-endpoint/configure-extension-file-exclusions-microsoft-defender-antivirus#validate-the-exclusion-list-by-using-mpcmdrun

If the answer is the right solution, please click "Accept Answer" and kindly upvote it.

I'm not getting the desired result with running the MpCmdRun.exe, in admin cmd mode"

Here's the syntax and result:

C:\ProgramData\Microsoft\Windows Defender\platform\4.18.24040.4-0>MpCmdRun.exe -CheckExclusion -path E:\X_Folder\TestFolderX

E:\X_Folder\TestFolderX [\Device\HarddiskVolume6\X_Folder\TestFolderX] is not excluded. Exit code is 1.

I'm assume that just adding E:\X_Folder in the exceptions list isn't enough...?

I'm trying to find any reference to Exit code 1 within the Windows Defender Doc but have not yet found any. I did find that it referenced that "Folder exclusions apply to all files and folders under that folder, unless the subfolder is a reparse point." So, I'm not sure the 'why'.

Hi,

Where do you run the MpCmdRun.exe? We should run the MpCmdRun.exe on the client computer that has applied the Antimalware Policy you configured in SCCM.

You may check the Exclusions list on your client computer to see if the folder "E:\X_Folder" is listed? (You may check my picture, in my example, the folder "C:\Temp" is listed in the exclusions list, so the subfolder is excluded when I run the MpCmdRun.exe)

Hope I explained it clearly.