PowerShell script to add Windows Defender exclusions for WSL2 and JetBrains IDE performance issues

Add_WindowsDefender_Exclusions.ps1

# PowerShell script to add Windows Defender exclusions for WSL2 and JetBrains IDE performance issues
# 
# For context please read this thread:
# https://github.com/microsoft/WSL/issues/8995
# 
# How to use?
# - Save the Script: Open a text editor like Notepad and paste the PowerShell script into it. 
# - Save the file with a .ps1 extension, for example, Add_WindowsDefender_Exclusions.ps1.
# - Run PowerShell as Administrator: Search for "PowerShell" in the Start menu, right-click on it, and choose "Run as administrator".
# - Navigate to the Script's Location: Use the cd command to navigate to the directory where you saved the .ps1 file. 
# - Run the Script: Type .\Add_WindowsDefender_Exclusions.ps1 and press Enter. This will execute the script.
# - You will be prompted to enter your WSL distro (tested only on Ubuntu), username and IDE of choice

# Check if running as administrator
$isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")
if (-not $isAdmin) {
    Write-Host "This script must be run as Administrator. Exiting."
    return
}

# Display IDE choices and prompt user to pick one
$ides = @("PhpStorm", "IntelliJ", "PyCharm", "RubyMine", "WebStorm", "DataGrip", "GoLand", "Rider", "Other")
$idePrompt = "Please select your IDE by typing the corresponding number:`n"
for ($i=0; $i -lt $ides.Length; $i++) {
    $idePrompt += "$i. $($ides[$i])`n"
}
$ideIndex = Read-Host $idePrompt
$selectedIDE = $ides[$ideIndex]

# Determine process based on IDE choice
$process = switch ($selectedIDE) {
    'PhpStorm' { "phpstorm64.exe" }
    'IntelliJ' { "idea64.exe" }
    'PyCharm'  { "pycharm64.exe" }
    'RubyMine' { "rubymine64.exe" }
    'WebStorm' { "webstorm64.exe" }
    'DataGrip' { "datagrip64.exe" }
    'GoLand'   { "goland64.exe" }
    'Rider'    { "rider64.exe" }
    'Other'    { Read-Host "Please enter the process name for your IDE (e.g., webstorm64.exe)" }
}
# Define folders to exclude, adjust if needed
$foldersToExclude = @(
    "C:\Users\$env:USERNAME\AppData\Local\JetBrains",
    "C:\Program Files\Docker",
    "C:\Program Files\JetBrains",
    "\\wsl$\$linuxDistro\home\$linuxUsername\src",
    "\\wsl.localhost\$linuxDistro\home\$linuxUsername\src"
)

# Define file types to exclude, adjust if needed
$fileTypesToExclude = @(
    "vhd",
    "vhdx"
)

# Define processes to exclude, adjust if needed
$processesToExclude = @(
    $process, # The process name based on the IDE choice
    "fsnotifier.exe",
    "jcef_helper.exe",
    "jetbrains-toolbox.exe",
    "docker.exe",
    "com.docker.*.*",
    "Desktop Docker.exe",
    "wsl.exe",
    "wslhost.exe",
    "vmmemWSL"
)

# Add Firewall Rule for WSL
# For details please read official documentation:
# https://www.jetbrains.com/help/idea/how-to-use-wsl-development-environment-in-product.html#debugging_system_settings
Write-Host "Adding firewall rules for WSL. This step may take a few minutes..."
try {
    New-NetFirewallRule -DisplayName "WSL" -Direction Inbound  -InterfaceAlias "vEthernet (WSL)"  -Action Allow
    Get-NetFirewallProfile -Name Public | Get-NetFirewallRule | Where-Object DisplayName -ILike "$($selectedIDE)*" | Disable-NetFirewallRule
} catch {
    Write-Host "Error adding firewall rule: $_"
}

# Add folder exclusions
Write-Host "Adding folder exclusions..."
foreach ($folder in $foldersToExclude) {
    Add-MpPreference -ExclusionPath $folder
}

# Add file type exclusions
Write-Host "Adding file type exclusions..."
foreach ($fileType in $fileTypesToExclude) {
    Add-MpPreference -ExclusionExtension $fileType
}

# Add process exclusions
Write-Host "Adding process exclusions..."
foreach ($process in $processesToExclude) {
    Add-MpPreference -ExclusionProcess $process
}

Write-Host "Script execution completed."

For those here having the same issue, I've just completely given up on Defender pinning my CPU all the time. Would prefer to have it on, but currently nigh unusable on my setup.

If you want to force Realtime protection off, you can use this registry key, since Microsoft insists that it will turn itself back on within a few hours on Fall Creator's and up.

Paste below into a file, add .reg extension, double click. Reboot and boom, hey, it's actually usable.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
"DisableAntiSpyware"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection]
"DisableBehaviorMonitoring"=dword:00000001
"DisableOnAccessProtection"=dword:00000001
"DisableScanOnRealtimeEnable"=dword:00000001