How to Audit Microsoft Defender Exclusions in Windows 11 (Find and Remove Malware Hiding Spots)

Your Windows 11 PC is slow, throwing weird pop-ups, or getting reinfected minutes after a “clean” scan. Usually one thing is to blame: something told Microsoft Defender to stop looking in a folder. Exclusions are a real Defender feature. But they’re also the easiest way for malware, or a careless tech, to hide files in plain sight.

This walkthrough shows you how to pull up every exclusion on your PC. You’ll spot the ones that don’t belong, remove them safely, and check Event Viewer to see what added them.

What Are Microsoft Defender Exclusions?

Exclusions tell Microsoft Defender to skip scanning a file, folder, file type, or process. They exist for good reasons. Defender shouldn’t slow down video editing software, clash with developer tools, or flag a program you already trust. But Defender never asks why an exclusion exists, or who added it. It just stops looking. One privileged command is all it takes for malware to add itself to that list. Once it’s there, real-time protection and scheduled scans never see it again.

Before You Begin

Make sure you have:

• A Windows 11 PC (any current build, including 23H2, 24H2, or 25H2)
• A local administrator account
• Microsoft Defender Antivirus active as the primary antivirus (not replaced by a third-party suite)
• A few minutes to review a short list; this audit is quick, not a full system scan

Requirement	Details
Device	Windows 11 desktop or laptop
OS version	Windows 11, any supported version
Access level	Local administrator
Tools used	Windows Security app, PowerShell (Admin), Event Viewer

If a third-party antivirus like Bitdefender, Malwarebytes, or ESET is protecting the PC, Defender’s exclusion list is usually inactive. Check that program’s own exclusions instead. The audit logic below still applies.

Step-by-Step Guide

Step 1: Confirm Defender Is the Active Antivirus

Before you audit anything, confirm Defender is actually doing the scanning. Click Start, type Windows Security, and open the app.

Look under Virus & threat protection on the home screen. A green checkmark and “No action needed” means Defender is active. See a message naming a different antivirus product? Its exclusions live there instead.

Step 2: Open Virus & Threat Protection Settings

Click the Virus & threat protection tile, then scroll down to Virus & threat protection settings and click Manage settings.

Step 3: Open the Exclusions List

Scroll to the bottom of the Manage settings page until you see Exclusions, then click Add or remove exclusions. Windows may prompt for administrator confirmation. Approve it.

This list is the whole point of the audit. Every entry here is a spot Defender never looks, no matter what’s hiding inside it.

Step 4: Review Every Entry Against Known Red Flags

Read through each exclusion and its type. Legitimate exclusions are narrow and tied to a specific, named app. Think a game’s install folder or a database engine’s data directory. Watch for these patterns:

• System folder exclusions: entries pointing at C:\Windows, C:\Windows\System32, or C:\Windows\Temp. Malware hides here because these locations look normal at a glance.
• Temp or Downloads folder exclusions: %TEMP%, C:\Users\<name>\Downloads, or C:\Users\<name>\AppData\Local\Temp. These are the most common places malware drops itself after a phishing download.
• Script interpreter exclusions: process exclusions for powershell.exe, cmd.exe, wscript.exe, or mshta.exe. Excluding the interpreter itself, instead of a specific script file, lets any malicious script run unscanned.
• Wildcard file-type exclusions: a File type exclusion for something broad like *.exe, *.dll, or *.scr. A legitimate app almost never needs to exclude an entire extension system-wide.
• Whole-drive exclusions: a Folder exclusion for C:\ or D:\ in their entirety. This quietly turns off scanning for the whole disk while Defender’s icon still says “protected.”
• Unfamiliar or misspelled paths: folders with names close to legitimate software (C:\ProgramData\Windowsupdate instead of WindowsUpdate) rely on you skimming past them.

Normal, low-risk exclusions usually point to one installed program’s folder, like C:\Program Files\Adobe\Premiere Pro. Or a developer tool’s working directory, like C:\Users\<name>\source\repos. They’re narrow, named, and traceable to software you recognize installing.

Step 5: Cross-Check Exclusions With PowerShell

The GUI list gets tedious fast on a PC with dozens of entries. It’s easy to miss a wildcard buried in a long path. Open PowerShell as Administrator: right-click Start, choose Windows Terminal (Admin), then run:

Get-MpPreference | Select-Object ExclusionPath, ExclusionExtension, ExclusionProcess

This dumps every path, extension, and process exclusion into one readable block. Paste it into a note, compare it to a past audit, or check a handful of PCs over a remote session. Need a fully expanded view of just one property? Run:

(Get-MpPreference).ExclusionPath

Step 6: Remove a Suspicious Exclusion via the GUI

For a single obvious red flag, the Windows Security app is the fastest route. Go back to Windows Security > Virus & threat protection > Manage settings > Add or remove exclusions.

• Locate the suspicious entry in the list.
• Click the entry to expand it, or select the three-dot / trash icon next to it.
• Click Remove.
• Confirm the administrator prompt if shown.

Step 7: Remove a Suspicious Exclusion via PowerShell

Cleaning up multiple entries, or working over a remote session where the GUI lags? PowerShell is faster and scriptable. In an elevated PowerShell window, run:

Remove-MpPreference -ExclusionPath "C:\Users\Public\update.exe"
Remove-MpPreference -ExclusionExtension ".exe"
Remove-MpPreference -ExclusionProcess "powershell.exe"

Run only the line that matches the exclusion type you’re removing. Swap in the actual path, extension, or process name from Step 5. Re-run Get-MpPreference to confirm. The entry should be gone.

Tip: To add back a legitimate exclusion you accidentally removed, use the matching Add-MpPreference cmdlet, for example Add-MpPreference -ExclusionPath "C:\Program Files\Adobe\Premiere Pro".

Step 8: Check Event Viewer for a History of Exclusion Changes

Knowing an exclusion is bad is one thing. Knowing when it showed up, and what added it, tells you how deep the compromise really goes. Click Start, type Event Viewer, and open it. Navigate to Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational.

Look for Event ID 5007. It logs configuration changes, including exclusion additions and removals. Click an event and check the General tab for the old and new values, plus the timestamp. Did the change happen right before the PC started behaving oddly? That’s your timeline.

Tip: If the Operational log looks empty or too short, right-click it, choose Properties, and increase Maximum log size so future changes aren’t rolled off after a few days.

Configuration: What “Clean” Looks Like

There’s no single “correct” exclusion list. A developer’s PC and a family member’s laptop will look nothing alike. Use this as a baseline for what a healthy exclusion list generally contains:

• Zero or very few entries on a typical home PC with no specialized software
• Entries tied to software you can name and remember installing
• Paths that are specific (a subfolder of Program Files), never a whole drive letter
• No process exclusions for powershell.exe, cmd.exe, or other built-in interpreters
• No file-type wildcards covering executables or scripts

If the PC is company-managed, exclusions are often set centrally through Group Policy or Microsoft Intune, not added locally. That’s expected, not a red flag.

If Something Goes Wrong

Exclusions look correct today, but the same suspicious entry reappears after a reboot? You’re dealing with an active infection that keeps re-adding it.

• Run a full Microsoft Defender scan immediately (Windows Security > Virus & threat protection > Scan options > Full scan).
• Check Task Scheduler and Settings > Apps > Startup for unfamiliar entries that could be re-adding the exclusion.
• Run Microsoft Safety Scanner as a second opinion. It’s a standalone, on-demand tool, separate from Defender’s own engine.
• If the exclusion keeps coming back after cleanup, back up your files. Consider a clean Windows reinstall instead of chasing it further.

Common Issues

“Add or remove exclusions” Is Greyed Out

Why it happens: The PC is connected to a work or school account, or Group Policy/Intune is managing Defender settings centrally. Windows Security typically shows a banner reading “Some settings are managed by your organization.”

Fix: On a personal PC, check Settings > Accounts > Access work or school and remove any connected work account if the device is genuinely personal. On a company-owned PC, don’t try to bypass this. Report the concern to IT so exclusions can be reviewed centrally.

A Removed Exclusion Comes Back on Its Own

Why it happens: A scheduled task, startup script, or running malicious process is silently re-adding the exclusion through PowerShell or a registry write.

Fix: Follow the “If Something Goes Wrong” steps above, full scan, check Task Scheduler and Startup apps, run Microsoft Safety Scanner, and consider a reinstall if it persists.

Windows Security Shows a Different Antivirus “In Control”

Why it happens: A third-party antivirus has taken over real-time protection, which disables Defender’s own exclusion management in the UI.

Fix: Open Settings > Apps > Installed apps, find the third-party antivirus, and manage exclusions through its own interface, or uninstall it to return control to Defender.

Get-MpPreference Returns an Error

Why it happens: PowerShell wasn’t launched with administrator rights.

Fix: Right-click Start, choose Windows Terminal (Admin) or PowerShell (Admin), and re-run the command.

No Relevant Events Appear in Event Viewer

Why it happens: The Windows Defender Operational log may be disabled or too small to retain older history.

Fix: Right-click the log, choose Enable Log if needed, and increase Maximum log size under the log’s Properties.

Tips and Hidden Features

• Document a baseline: After your first clean audit, save the output of Get-MpPreference to a text file so future checks are a quick comparison instead of a cold read.
• Pair with a full scan: An exclusions audit and a full scan work best together. The exclusion review finds hiding spots. The scan checks what’s actually there.
• Watch for post-uninstall leftovers: Uninstalling an app rarely removes its Defender exclusion automatically. Clear these out as part of routine software cleanup.
• Small office checkups: For several PCs, script Get-MpPreference over PowerShell remoting to review exclusions across an office without opening the GUI on each machine.

Wrapping Up

Get-MpPreference plus a scroll through the GUI list takes under five minutes. It’s also the step almost everyone skips when cleaning up a suspicious PC. You run a full scan first. It comes back clean. The problem is obviously still there.

Check exclusions before you run that scan next time. A full scan was never going to find an infected folder Defender’s been told to ignore.

Step	Action	Applies To
1–3	Open Windows Security and view the exclusions list	All Windows 11 PCs
4	Compare entries against red-flag patterns	All Windows 11 PCs
5	Cross-check with Get-MpPreference in PowerShell	Power users, IT support
6–7	Remove suspicious entries via GUI or PowerShell	All Windows 11 PCs
8	Review Event Viewer for change history	Suspected compromise, inherited PCs

Resources

• Add an exclusion to Windows Security
• Configure and validate exclusions for Microsoft Defender Antivirus scans
• Get-MpPreference PowerShell reference
• Windows 11 release information