Error while running the Windows Defender exclusion check

[azoitl]

We got the feedback for 4diac IDE that on sum windows machines the Windows Defender exclusion check throws an exception (eclipse-4diac/4diac-ide#1949). To check if it is with 4diac IDE or with the Eclipse Platform we downloaded a fresh Eclipse IDE 2025-12 and we could reproduce the problem with that exception (see below).

In the mean time we see this happening with more users. Some of them have a different anti virus software, some run windows defender. Unfortunately we have not yet an understanding what causes the problem. You can see more in this matrix thread: https://chat.eclipse.org/#/room/!yVjgkwgBPbjMVDziCd:matrix.eclipse.org/$1a4JH_uhQAX7h5dcovdeq9vfNXVFWgrOT3oVl5_wP0g?via=matrix.eclipse.org&via=matrix.org

However I looked into the place that is throwing the exception and my question would be should we fail silent in cases where the windows defender check is returning unexpected values?

If yes, I'm happy to provide a PR for that.

Here is some relevant log output

From <workspace>/.metadata/.log

org.eclipse.core.runtime.CoreException: Failed to retrieve Microsoft Defender status.
	at org.eclipse.ui.internal.WindowsDefenderConfigurator.isWindowsDefenderActive(WindowsDefenderConfigurator.java:332)
	at org.eclipse.ui.internal.WindowsDefenderConfigurator.runExclusionCheck(WindowsDefenderConfigurator.java:159)
	at org.eclipse.ui.internal.WindowsDefenderConfigurator.runCheckEnforced(WindowsDefenderConfigurator.java:144)
	at org.eclipse.ui.internal.dialogs.StartupPreferencePage.lambda$0(StartupPreferencePage.java:123)
	at org.eclipse.swt.events.SelectionListener$1.widgetSelected(SelectionListener.java:83)
	at org.eclipse.swt.widgets.TypedListener.handleEvent(TypedListener.java:290)
	at org.eclipse.swt.widgets.EventTable.sendEvent(EventTable.java:91)
	at org.eclipse.swt.widgets.Display.sendEvent(Display.java:4364)
	at org.eclipse.swt.widgets.Widget.sendEvent(Widget.java:1217)
	at org.eclipse.swt.widgets.Display.runDeferredEvents(Display.java:4162)
	at org.eclipse.swt.widgets.Display.readAndDispatch(Display.java:3750)
	at org.eclipse.jface.window.Window.runEventLoop(Window.java:824)
	at org.eclipse.jface.window.Window.open(Window.java:804)
	at org.eclipse.ui.internal.OpenPreferencesAction.run(OpenPreferencesAction.java:64)
	at org.eclipse.jface.action.Action.runWithEvent(Action.java:474)
	at org.eclipse.jface.action.ActionContributionItem.handleWidgetSelection(ActionContributionItem.java:581)
	at org.eclipse.jface.action.ActionContributionItem.lambda$4(ActionContributionItem.java:415)
	at org.eclipse.swt.widgets.EventTable.sendEvent(EventTable.java:91)
	at org.eclipse.swt.widgets.Display.sendEvent(Display.java:4364)
	at org.eclipse.swt.widgets.Widget.sendEvent(Widget.java:1217)
	at org.eclipse.swt.widgets.Display.runDeferredEvents(Display.java:4162)
	at org.eclipse.swt.widgets.Display.readAndDispatch(Display.java:3750)
	at org.eclipse.e4.ui.internal.workbench.swt.PartRenderingEngine$5.run(PartRenderingEngine.java:1147)
	at org.eclipse.core.databinding.observable.Realm.runWithDefault(Realm.java:339)
	at org.eclipse.e4.ui.internal.workbench.swt.PartRenderingEngine.run(PartRenderingEngine.java:1038)
	at org.eclipse.e4.ui.internal.workbench.E4Workbench.createAndRunUI(E4Workbench.java:153)
	at org.eclipse.ui.internal.Workbench.lambda$3(Workbench.java:677)
	at org.eclipse.core.databinding.observable.Realm.runWithDefault(Realm.java:339)
	at org.eclipse.ui.internal.Workbench.createAndRunWorkbench(Workbench.java:583)
	at org.eclipse.ui.PlatformUI.createAndRunWorkbench(PlatformUI.java:173)
	at org.eclipse.ui.internal.ide.application.IDEApplication.start(IDEApplication.java:185)
	at org.eclipse.equinox.internal.app.EclipseAppHandle.run(EclipseAppHandle.java:219)
	at org.eclipse.core.runtime.internal.adaptor.EclipseAppLauncher.runApplication(EclipseAppLauncher.java:149)
	at org.eclipse.core.runtime.internal.adaptor.EclipseAppLauncher.start(EclipseAppLauncher.java:115)
	at org.eclipse.core.runtime.adaptor.EclipseStarter.run(EclipseStarter.java:467)
	at org.eclipse.core.runtime.adaptor.EclipseStarter.run(EclipseStarter.java:298)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(Unknown Source)
	at java.base/java.lang.reflect.Method.invoke(Unknown Source)
	at org.eclipse.equinox.launcher.Main.invokeFramework(Main.java:615)
	at org.eclipse.equinox.launcher.Main.basicRun(Main.java:563)
	at org.eclipse.equinox.launcher.Main.run(Main.java:1415)
Caused by: java.io.IOException: Process terminated with unexpected result:

	at org.eclipse.ui.internal.WindowsDefenderConfigurator.isWindowsDefenderActive(WindowsDefenderConfigurator.java:329)
	... 40 more

Tested under this environment:

• Windows 11
• Eclipse IDE/Platform version (as shown in Help > About): Eclipse 2025-12

Community

• I understand reporting an issue to this OSS project does not mandate anyone to fix it. Other contributors may consider the issue, or not, at their own convenience. The most efficient way to get it fixed is that I fix it myself and contribute it back as a good quality patch to the project.

[azoitl]

PS I also looked through the recent PRs that mention windows defender and I could not see any that could be seen as cause for this. Most probably Microsoft changed something.

[Mailaender]

Can you post the PowerShell output (and exit code) of Get-MpComputerStatus? See https://learn.microsoft.com/en-us/powershell/module/defender/get-mpcomputerstatus?view=windowsserver2019-ps

[akurtakov]

@HeikoKlare As our windows guy, what would you say?

[azoitl]

Can you post the PowerShell output (and exit code) of Get-MpComputerStatus? See https://learn.microsoft.com/en-us/powershell/module/defender/get-mpcomputerstatus?view=windowsserver2019-ps

@Mailaender I have unfortunately no access to a problematic machine. But the user who originally reported it wrote that the Get-MpComputerStatus just does not reply anything.

[merks]

Ask which JDK version is used. It seems to me it doesn’t work with Java 25.

[Mailaender]

This also happens with Java 21. Maybe instead of rethrowing, we should ignore and log when this happens.

eclipse.platform.ui/bundles/org.eclipse.ui.workbench/eclipseui/org/eclipse/ui/internal/WindowsDefenderConfigurator.java

Lines 329 to 332 in 0183152

	default -> throw new IOException("Process terminated with unexpected result:\n" + String.join("\n", lines)); //$NON-NLS-1$//$NON-NLS-2$
	};
	} catch (IOException e) {
	throw new CoreException(Status.error(WorkbenchMessages.WindowsDefenderConfigurator_statusCheckFailed, e));

[azoitl]

@merks for 4diac IDE it is JustJ 2.

@Mailaender this is what I tried to propose in my initial report.

[akurtakov]

It looks like https://pupuweb.com/how-do-i-fix-windows-defender-errors-to-prevent-ztna-quarantine/

[Mailaender]

It is an intentional fix by @microsoft not a bug: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62468

[akurtakov]

The way I read these is - they try to fix vulnerabililty but introduce conflicts in the process and that's the bug hit here.

[azoitl]

Is there a way to disable the check when our RCP is using as application org.eclipse.ui.ide.workbench?

Should I prepare a PR that is handling that situation more gracefully?

[f-hoepfinger-hr-agrartechnik]

Get-MpComputerStatus

PS C:\Users\franz> Get-MpComputerStatus

AMEngineVersion : 1.1.25110.1
AMProductVersion : 4.18.25110.6
AMRunningMode : Normal
AMServiceEnabled : True
AMServiceVersion : 4.18.25110.6
AntispywareEnabled : True
AntispywareSignatureAge : 0
AntispywareSignatureLastUpdated : 17.12.2025 13:56:54
AntispywareSignatureVersion : 1.443.178.0
AntivirusEnabled : True
AntivirusSignatureAge : 0
AntivirusSignatureLastUpdated : 17.12.2025 13:56:54
AntivirusSignatureVersion : 1.443.178.0
BehaviorMonitorEnabled : True
ComputerID : E38B27D9-BDAF-4765-B472-C6ECFE653BBC
ComputerState : 0
DefenderSignaturesOutOfDate : False
DeviceControlDefaultEnforcement :
DeviceControlPoliciesLastUpdated : 01.01.1601 01:00:00
DeviceControlState : Disabled
FullScanAge : 4294967295
FullScanEndTime :
FullScanOverdue : False
FullScanRequired : False
FullScanSignatureVersion :
FullScanStartTime :
InitializationProgress : ServiceStartedSuccessfully
IoavProtectionEnabled : True
IsTamperProtected : True
IsVirtualMachine : False
LastFullScanSource : 0
LastQuickScanSource : 2
NISEnabled : True
NISEngineVersion : 1.1.25110.1
NISSignatureAge : 0
NISSignatureLastUpdated : 17.12.2025 13:56:54
NISSignatureVersion : 1.443.178.0
OnAccessProtectionEnabled : True
ProductStatus : 524288
QuickScanAge : 0
QuickScanEndTime : 17.12.2025 17:29:09
QuickScanOverdue : False
QuickScanSignatureVersion : 1.443.174.0
QuickScanStartTime : 17.12.2025 17:28:07
RealTimeProtectionEnabled : True
RealTimeScanDirection : 0
RebootRequired : False
SmartAppControlExpiration :
SmartAppControlState : Off
TamperProtectionSource : Signatures
TDTCapable : N/A
TDTMode : N/A
TDTSiloType : N/A
TDTStatus : N/A
TDTTelemetry : N/A
TroubleShootingDailyMaxQuota :
TroubleShootingDailyQuotaLeft :
TroubleShootingEndTime :
TroubleShootingExpirationLeft :
TroubleShootingMode :
TroubleShootingModeSource :
TroubleShootingQuotaResetTime :
TroubleShootingStartTime :
PSComputerName :

PS C:\Users\franz>

[f-hoepfinger-hr-agrartechnik]

PS C:\Users\franz> Get-MpComputerStatus | Select-Object AMProductVersion, AMEngineVersion, AntivirusSignatureVersion

AMProductVersion AMEngineVersion AntivirusSignatureVersion

---

4.18.25110.6 1.1.25110.1 1.443.178.0

PS C:\Users\franz>