Skip to content

Instantly share code, notes, and snippets.

Show Gist options
  • Select an option

  • Save nerzhulart/89c6a376b521a6e7eb69a04277a9489a to your computer and use it in GitHub Desktop.

Select an option

Save nerzhulart/89c6a376b521a6e7eb69a04277a9489a to your computer and use it in GitHub Desktop.
Adds Windows Defender exclusions for developers (Visual Studio, JetBrains Rider, IntellIJ Idea, Git, MsBuild, dotnet, mono etc.)
$userPath = $env:USERPROFILE
$pathExclusions = New-Object System.Collections.ArrayList
$processExclusions = New-Object System.Collections.ArrayList
$pathExclusions.Add('C:\Windows\Microsoft.NET') > $null
$pathExclusions.Add('C:\Windows\assembly') > $null
$pathExclusions.Add($userPath + '\AppData\Local\Microsoft\VisualStudio') > $null
$pathExclusions.Add('C:\ProgramData\Microsoft\VisualStudio\Packages') > $null
$pathExclusions.Add('C:\Program Files (x86)\MSBuild') > $null
$pathExclusions.Add('C:\Program Files (x86)\Microsoft Visual Studio 14.0') > $null
$pathExclusions.Add('C:\Program Files (x86)\Microsoft Visual Studio 10.0') > $null
$pathExclusions.Add('C:\Program Files (x86)\Microsoft Visual Studio') > $null
$pathExclusions.Add('C:\Program Files (x86)\Microsoft SDKs\NuGetPackages') > $null
$pathExclusions.Add('C:\Program Files (x86)\Microsoft SDKs') > $null
# VS
$processExclusions.Add('vshost-clr2.exe') > $null
$processExclusions.Add('VSInitializer.exe') > $null
$processExclusions.Add('VSIXInstaller.exe') > $null
$processExclusions.Add('VSLaunchBrowser.exe') > $null
$processExclusions.Add('vsn.exe') > $null
$processExclusions.Add('VsRegEdit.exe') > $null
$processExclusions.Add('VSWebHandler.exe') > $null
$processExclusions.Add('VSWebLauncher.exe') > $null
$processExclusions.Add('XDesProc.exe') > $null
$processExclusions.Add('Blend.exe') > $null
$processExclusions.Add('DDConfigCA.exe') > $null
$processExclusions.Add('devenv.exe') > $null
$processExclusions.Add('FeedbackCollector.exe') > $null
$processExclusions.Add('Microsoft.VisualStudio.Web.Host.exe') > $null
$processExclusions.Add('mspdbsrv.exe') > $null
$processExclusions.Add('MSTest.exe') > $null
$processExclusions.Add('PerfWatson2.exe') > $null
$processExclusions.Add('Publicize.exe') > $null
$processExclusions.Add('QTAgent.exe') > $null
$processExclusions.Add('QTAgent_35.exe') > $null
$processExclusions.Add('QTAgent_40.exe') > $null
$processExclusions.Add('QTAgent32.exe') > $null
$processExclusions.Add('QTAgent32_35.exe') > $null
$processExclusions.Add('QTAgent32_40.exe') > $null
$processExclusions.Add('QTDCAgent.exe') > $null
$processExclusions.Add('QTDCAgent32.exe') > $null
$processExclusions.Add('StorePID.exe') > $null
$processExclusions.Add('T4VSHostProcess.exe') > $null
$processExclusions.Add('TailoredDeploy.exe') > $null
$processExclusions.Add('TCM.exe') > $null
$processExclusions.Add('TextTransform.exe') > $null
$processExclusions.Add('TfsLabConfig.exe') > $null
$processExclusions.Add('UserControlTestContainer.exe') > $null
$processExclusions.Add('vb7to8.exe') > $null
$processExclusions.Add('VcxprojReader.exe') > $null
$processExclusions.Add('VsDebugWERHelper.exe') > $null
$processExclusions.Add('VSFinalizer.exe') > $null
$processExclusions.Add('VsGa.exe') > $null
$processExclusions.Add('VSHiveStub.exe') > $null
$processExclusions.Add('vshost.exe') > $null
$processExclusions.Add('vshost32.exe') > $null
$processExclusions.Add('vshost32-clr2.exe') > $null
# VS Code
$processExclusions.Add('Code - Insiders.exe') > $null
# Runtimes, build tools
$processExclusions.Add('dotnet.exe') > $null
$processExclusions.Add('mono.exe') > $null
$processExclusions.Add('mono-sgen.exe') > $null
$processExclusions.Add('java.exe') > $null
$processExclusions.Add('java64.exe') > $null
$processExclusions.Add('msbuild.exe') > $null
$processExclusions.Add('node.exe') > $null
$processExclusions.Add('node.js') > $null
$processExclusions.Add('perfwatson2.exe') > $null
$processExclusions.Add('ServiceHub.Host.Node.x86.exe') > $null
$processExclusions.Add('vbcscompiler.exe') > $null
$processExclusions.Add('nuget.exe') > $null
# VCS
$processExclusions.Add('git.exe') > $null
# Shells
$processExclusions.Add('git-bash.exe') > $null
$processExclusions.Add('bash.exe') > $null
$processExclusions.Add('powershell.exe') > $null
# All of JetBrains stuff
$processExclusions.Add('JetBrains.EntityFramework.Runner620.exe') > $null
$processExclusions.Add('JetBrains.MsBuild.TaskEntryPoint.exe') > $null
$processExclusions.Add('JetBrains.Platform.Satellite.exe') > $null
$processExclusions.Add('JetBrains.ReSharper.Features.XamlPreview.External.exe') > $null
$processExclusions.Add('JetBrains.ReSharper.Host.exe') > $null
$processExclusions.Add('JetBrains.ReSharper.Host64.exe') > $null
$processExclusions.Add('JetBrains.ReSharper.Roslyn.Worker.exe') > $null
$processExclusions.Add('JetLauncher32.exe') > $null
$processExclusions.Add('JetLauncher32c.exe') > $null
$processExclusions.Add('JetLauncher64.exe') > $null
$processExclusions.Add('JetLauncher64c.exe') > $null
$processExclusions.Add('JetLauncherIL.exe') > $null
$processExclusions.Add('JetLauncherILc.exe') > $null
$processExclusions.Add('OperatorsResolveCacheGenerator.exe') > $null
$processExclusions.Add('PsiGen.exe') > $null
$processExclusions.Add('ReSharperTestRunner32.exe') > $null
$processExclusions.Add('ReSharperTestRunner64.exe') > $null
$processExclusions.Add('ReSharperTestRunnerIL.exe') > $null
$processExclusions.Add('RiderClrProcessEnumerator32.exe') > $null
$processExclusions.Add('RiderClrProcessEnumeratorIL.exe') > $null
$processExclusions.Add('TokenGenerator.exe') > $null
$processExclusions.Add('xamarin-component.exe') > $null
$processExclusions.Add('ClrStack.x64.exe') > $null
$processExclusions.Add('ClrStack.x86.exe') > $null
$processExclusions.Add('CsLex.exe') > $null
$processExclusions.Add('ErrorsGen.exe') > $null
$processExclusions.Add('JetBrains.Debugger.Worker.exe') > $null
$processExclusions.Add('JetBrains.Debugger.Worker32c.exe') > $null
$processExclusions.Add('JetBrains.Debugger.Worker64c.exe') > $null
$processExclusions.Add('dotPeek32.exe') > $null
$processExclusions.Add('dotPeek64.exe') > $null
$processExclusions.Add('DotTabWellScattered32.exe') > $null
$processExclusions.Add('DotTabWellScattered64.exe') > $null
$processExclusions.Add('DotTabWellScatteredIL.exe') > $null
$processExclusions.Add('JetBrains.Platform.Installer.Bootstrap.exe') > $null
$processExclusions.Add('JetBrains.Platform.Installer.Cleanup.exe') > $null
$processExclusions.Add('JetBrains.Platform.Installer.exe') > $null
$processExclusions.Add('CleanUpProfiler.x64.exe') > $null
$processExclusions.Add('CleanUpProfiler.x86.exe') > $null
$processExclusions.Add('Configuration2Xml32.exe') > $null
$processExclusions.Add('Configuration2Xml64.exe') > $null
$processExclusions.Add('ConsoleProfiler.exe') > $null
$processExclusions.Add('dotTrace32.exe') > $null
$processExclusions.Add('dotTrace64.exe') > $null
$processExclusions.Add('DotTraceLauncher.exe') > $null
$processExclusions.Add('dotTraceView32.exe') > $null
$processExclusions.Add('dotTraceView64.exe') > $null
$processExclusions.Add('JetBrains.Common.ElevationAgent.exe') > $null
$processExclusions.Add('JetBrains.Common.ExternalStorage.exe') > $null
$processExclusions.Add('JetBrains.Common.ExternalStorage.x86.exe') > $null
$processExclusions.Add('JetBrains.dotTrace.IntegrationDemo.exe') > $null
$processExclusions.Add('Reporter.exe') > $null
$processExclusions.Add('SnapshotStat.exe') > $null
$processExclusions.Add('Timeline32.exe') > $null
$processExclusions.Add('Timeline64.exe') > $null
$processExclusions.Add('dotMemory.UI.32.exe') > $null
$processExclusions.Add('dotMemory.UI.64.exe') > $null
$processExclusions.Add('dotMemoryUnit.exe') > $null
$processExclusions.Add('JetBrains.dotMemory.Console.SingleExe.exe') > $null
$processExclusions.Add('JetBrains.dotMemoryUnit.Server.exe') > $null
$processExclusions.Add('restarter.exe') > $null
$processExclusions.Add('rider64.exe') > $null
$processExclusions.Add('runnerw.exe') > $null
$processExclusions.Add('runnerw64.exe') > $null
$processExclusions.Add('WinProcessListHelper.exe') > $null
$processExclusions.Add('elevator.exe') > $null
$processExclusions.Add('fsnotifier.exe') > $null
$processExclusions.Add('fsnotifier64.exe') > $null
$processExclusions.Add('launcher.exe') > $null
$processExclusions.Add('NGen Rider Assemblies.exe') > $null
$processExclusions.Add('idea.exe') > $null
$processExclusions.Add('idea64.exe') > $null
$processExclusions.Add('JetBrains.Etw.Collector.Host.exe') > $null
# JB Toolbox
$processExclusions.Add('jetbrains-toolbox.exe') > $null
$processExclusions.Add('jetbrains-toolbox-cef.exe') > $null
$processExclusions.Add('jetbrains-toolbox-cef-helper.exe') > $null
# Unity
$processExclusions.Add('UnityHelper.exe') > $null
$processExclusions.Add('Unity.exe') > $null
$processExclusions.Add('UnityShaderCompiler.exe') > $null
$processExclusions.Add('UnityYAMLMerge.exe') > $null
$processExclusions.Add('UnityCrashHandler64.exe') > $null
Write-Host "This script will create Windows Defender exclusions for common Visual Studio 2017 folders and processes."
Write-Host ""
$projectsFolder = Read-Host 'What is the path to your Projects folder? (example: c:\projects)'
Write-Host ""
Write-Host "Adding Path Exclusion: " $projectsFolder
Add-MpPreference -ExclusionPath $projectsFolder
foreach ($exclusion in $pathExclusions)
{
Write-Host "Adding Path Exclusion: " $exclusion
Add-MpPreference -ExclusionPath $exclusion
}
foreach ($exclusion in $processExclusions)
{
Write-Host "Adding Process Exclusion: " $exclusion
Add-MpPreference -ExclusionProcess $exclusion
}
Write-Host ""
Write-Host "Your Exclusions:"
$prefs = Get-MpPreference
$prefs.ExclusionPath
$prefs.ExclusionProcess
Write-Host ""
Write-Host "Enjoy faster build times and coding!"
Write-Host ""
@oskaremil

Copy link
Copy Markdown

Add support for additional JetBrains products ?

$processExclusions.Add('webstorm64.exe') > $null
$processExclusions.Add('datagrip64.exe') > $null
$processExclusions.Add('clion64.exe') > $null
$processExclusions.Add('goland64.exe') > $null
$processExclusions.Add('phpstorm64.exe') > $null
$processExclusions.Add('pycharm64.exe') > $null
$processExclusions.Add('rubymine64.exe') > $null
$processExclusions.Add('studio64.exe') > $null

@oskaremil

Copy link
Copy Markdown

And ReSharper cache folder

$pathExclusions.Add($userPath + '\AppData\Local\JetBrains\Transient') > $null

@peterwake

Copy link
Copy Markdown

Surely whitelisting these processes leaves you open to anyone just using these process names?

@ryedigaryan

ryedigaryan commented Jan 4, 2021

Copy link
Copy Markdown

Surely whitelisting these processes leaves you open to anyone just using these process names?

I was thinking of it too and found this topic on windows official website: How to add a file type or process exclusion to Windows Security.
Which says that you can specify the full path, as well as use asterisk (*): C:\MyProcess\* will exclude files opened by all processes, located in C:\MyProcess, or any subfolders of C:\MyProcess.
This adds a bit of security

@seankearon

Copy link
Copy Markdown

I have excluded Rider processes using the c:\myprocess\* format mentioned by @ryedigaryan above (but with the Rider root folder) and it seems to work well!

@Neboer

Neboer commented Oct 20, 2022

Copy link
Copy Markdown

Thank you! You are a lifesaver for me! This is very convenient!

@sytolk

sytolk commented Feb 19, 2024

Copy link
Copy Markdown

Before to run this script it's need to run from power shell:
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass

@Borgquite

Copy link
Copy Markdown

Microsoft have a whole load of these processes on the following list https://learn.microsoft.com/en-us/defender-endpoint/common-exclusion-mistakes-microsoft-defender-antivirus#processes:

They say:

You shouldn't exclude some processes from scans, because attackers might use these processes. In general, don't define exclusions for the following processes.

They also recommend setting the fully qualified path to the file, not just the bare file name.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment