Script to add Regkey Exception to Windows Defender

Question

If I want some kind of script to add an exclusion to Windows file defender, I can do something along these lines by saving the following text as a .bat file and running it:

powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "mypath"

But what if I want to add, specifically, a registry entry exception to Windows defender in a similar manner, how would I acheive that? Is it even possible to add a registry entry as an exception to Windows defender?

Solution 1

Not really an answer, but I do it through the registry here is the info:

File and folder exclusions are stored in the registry key below.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths

File type exclusions are stored in the registry key below.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions

Process exclusions are stored in the registry key below.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes

Sincerely,

Alvaro Lamadrid

Solution 2

As I see, you can create an exception with Powershell with that code:

Add-MpPreference -ExclusionPath %NameOfThePathOrFile% -Force

-Force command is for bypass user confirmation.

Other feature required for work is running PowerShell (at least) as admin, so you can do it with:

reg query "HKU\S-1-5-19\Environment" >nul 2>&1
if not %errorlevel% EQU 0 (
    cls
    powershell.exe -windowstyle hidden -noprofile "Start-Process '%~dpnx0' -Verb RunAs"
    exit
)

You can made a goto first of all like:

goto Admin
START Powershell -nologo -noninteractive -windowStyle hidden -noprofile -command ^
Add-MpPreference -ExclusionPath %NameOfThePath% -Force;
:Admin
reg query "HKU\S-1-5-19\Environment" >nul 2>&1
if not %errorlevel% EQU 0 (
    cls
    powershell.exe -windowstyle hidden -noprofile "Start-Process '%~dpnx0' -Verb RunAs"
    exit
)

Hope that helps.

Comments

[ereHsaWyhsipS]

That's actually a better solution than the old method that I was using, but take a look here: i.imgur.com/tkxBCxv.png Notice how one of the items is a "regkey" as opposed to a "file." How would I add that regkey as an exclusion using your method?

[sean christe]

Can you add registry exclusions? It looks like even throught the GUI you can only add File, File Type, Folder, or Process exceptions.

[Alvaro Lamadrid]

Here is Microsoft official documentation of the different ways IT Professionals have to manage exclusions in Windows Defender. docs.microsoft.com/en-us/windows/security/threat-protection/‌​…

[sean christe]

So it looks like no you cannot have registry exclusions.

[aemonge]

But how's the syntax of these registrys ? Let's say I need C:\wsl and C:\other this both forlders excluded, how would I change the value on the registry to achive this ?