Skip to content

Commit 5da1694

Browse files
committed
Update configure-extension-file-exclusions-microsoft-defender-antivirus.md
1 parent 0984121 commit 5da1694

File tree

1 file changed

+10
-10
lines changed

1 file changed

+10
-10
lines changed

defender-endpoint/configure-extension-file-exclusions-microsoft-defender-antivirus.md

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ search.appverid: met150
3030

3131
- Windows
3232

33-
You can define exclusions for Microsoft Defender Antivirus that apply to [scheduled scans](schedule-antivirus-scans.md), [on-demand scans](run-scan-microsoft-defender-antivirus.md), and [always-on, real-time protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md). **Generally, you don't need to apply exclusions**. If you do need to apply exclusions, then you can choose from the following:
33+
You can define exclusions for Microsoft Defender Antivirus that apply to [scheduled scans](schedule-antivirus-scans.md), [on-demand scans](run-scan-microsoft-defender-antivirus.md), and [always-on, real-time protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md). **Generally, you don't need to apply exclusions**. If you do need to apply exclusions, then you can choose from the following types:
3434

3535
- Exclusions based on file extensions and folder locations (described in this article)
3636
- [Exclusions for files that are opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md)
@@ -46,7 +46,7 @@ See [Recommendations for defining exclusions](configure-exclusions-microsoft-def
4646

4747
## Exclusion lists
4848

49-
To exclude certain files from Microsoft Defender Antivirus scans, modify your exclusion lists. Microsoft Defender Antivirus includes many automatic exclusions based on known operating system behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations.
49+
To exclude certain files from Microsoft Defender Antivirus scans, modify your exclusion lists. Microsoft Defender Antivirus includes many automatic exclusions based on known operating system behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios.
5050

5151
> [!NOTE]
5252
> Exclusions apply to [potentially unwanted apps (PUA) detections](detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md) as well.
@@ -111,7 +111,7 @@ See [How to create and deploy antimalware policies: Exclusion settings](/configm
111111
1. Set the option to **Enabled**.
112112
2. Under the **Options** section, select **Show**.
113113
3. Specify each folder on its own line under the **Value name** column.
114-
4. If you are specifying a file, ensure that you enter a fully qualified path to the file, including the drive letter, folder path, file name, and extension.
114+
4. If you're specifying a file, ensure that you enter a fully qualified path to the file, including the drive letter, folder path, file name, and extension.
115115
5. Enter **0** in the **Value** column.
116116

117117
5. Choose **OK**.
@@ -150,7 +150,7 @@ The following table lists values that you can use in the `<exclusion list>` port
150150
|Exclusion type|PowerShell parameter|
151151
|---|---|
152152
|All files with a specified file extension|`-ExclusionExtension`|
153-
|All files under a folder (including files in sub-directories), or a specific file|`-ExclusionPath`|
153+
|All files under a folder (including files in subdirectories), or a specific file|`-ExclusionPath`|
154154

155155
> [!IMPORTANT]
156156
> If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again overwrites the existing list.
@@ -297,7 +297,7 @@ You can retrieve the items in the exclusion list by using one of the following m
297297
If you use PowerShell, you can retrieve the list in the following two ways:
298298

299299
- Retrieve the status of all Microsoft Defender Antivirus preferences. Each list is displayed on separate lines, but the items within each list are combined into the same line.
300-
- Write the status of all preferences to a variable, and use that variable to only call the specific list you are interested in. Each use of `Add-MpPreference` is written to a new line.
300+
- Write the status of all preferences to a variable, and use that variable to only call the specific list you're interested in. Each use of `Add-MpPreference` is written to a new line.
301301

302302
### Validate the exclusion list by using MpCmdRun
303303

@@ -349,28 +349,28 @@ For more information, see [Use PowerShell cmdlets to configure and run Microsoft
349349

350350
You can validate that your exclusion lists are working by using PowerShell with either the `Invoke-WebRequest` cmdlet or the .NET WebClient class to download a test file.
351351

352-
In the following PowerShell snippet, replace `test.txt` with a file that conforms to your exclusion rules. For example, if you have excluded the `.testing` extension, replace `test.txt` with `test.testing`. If you're testing a path, make sure that you run the cmdlet within that path.
352+
In the following PowerShell snippet, replace `test.txt` with a file that conforms to your exclusion rules. For example, if you're excluding the `.testing` extension, replace `test.txt` with `test.testing`. If you're testing a path, make sure that you run the cmdlet within that path.
353353

354354
```PowerShell
355355
Invoke-WebRequest "https://secure.eicar.org/eicar.com.txt" -OutFile "test.txt"
356356
```
357357

358-
If Microsoft Defender Antivirus reports malware, then the rule is not working. If there is no report of malware and the downloaded file exists, then the exclusion is working. You can open the file to confirm the contents are the same as what is described on the [EICAR test file website](https://www.eicar.org/download-anti-malware-testfile/).
358+
If Microsoft Defender Antivirus reports malware, then the rule isn't working. If there's no report of malware and the downloaded file exists, then the exclusion is working. You can open the file to confirm the contents are the same as what is described on the [EICAR test file website](https://www.eicar.org/download-anti-malware-testfile/).
359359

360-
You can also use the following PowerShell code, which calls the .NET WebClient class to download the test file - as with the `Invoke-WebRequest` cmdlet; replace `c:\test.txt` with a file that conforms to the rule you are validating:
360+
You can also use the following PowerShell code, which calls the .NET WebClient class to download the test file - as with the `Invoke-WebRequest` cmdlet; replace `c:\test.txt` with a file that conforms to the rule you're validating:
361361

362362
```PowerShell
363363
$client = new-object System.Net.WebClient
364364
$client.DownloadFile("http://www.eicar.org/download/eicar.com.txt","c:\test.txt")
365365
```
366366

367-
If you do not have Internet access, you can create your own EICAR test file by writing the EICAR string to a new text file with the following PowerShell command:
367+
If you don't have Internet access, you can create your own EICAR test file by writing the EICAR string to a new text file with the following PowerShell command:
368368

369369
```PowerShell
370370
[io.file]::WriteAllText("test.txt",'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*')
371371
```
372372

373-
You can also copy the string into a blank text file and attempt to save it with the file name or in the folder you are attempting to exclude.
373+
You can also copy the string into a blank text file and attempt to save it with the file name or in the folder you're attempting to exclude.
374374

375375

376376
## See also

0 commit comments

Comments
 (0)