{"id":47041,"date":"2023-05-19T17:16:03","date_gmt":"2023-05-19T11:46:03","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=47041"},"modified":"2023-08-07T13:48:19","modified_gmt":"2023-08-07T08:18:19","slug":"cant-delete-defender-exclusions","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/cant-delete-defender-exclusions\/","title":{"rendered":"Fix: Cannot Delete Microsoft Defender Exclusions"},"content":{"rendered":"

When you open Windows Security \u2192 Virus and Threat Protection\u00a0 \u2192 Manage Settings \u2192 Add or remove exclusions, you may be able to delete the exclusions by clicking on the “Remove” button.<\/p>\n

Also, the Remove-MpPreference<\/code> PowerShell command may not help.<\/p>\n

RELATED:<\/strong> How to Bulk Reset Exclusions in Windows Defender<\/a><\/div>\n

Cause<\/h2>\n

The exclusion may have been added as a policy setting. The policy setting needs to be removed using the Registry Editor or the Group Policy Editor.<\/p>\n

Resolution<\/h2>\n

To remove the exclusions (policy), follow one of these methods:<\/p>\n

Option 1: Remove Microsoft Defender Policies<\/h3>\n
    \n
  1. Download defender-policies-remove.reg<\/a> (zipped).<\/li>\n
  2. Unzip and run the enclosed REG file.\u00a0After running it, you may want to open the Registry Editor to ensure the \u201cWindows Defender\u201d Policies key doesn\u2019t exist.<\/li>\n
  3. Once done, restart Windows for the changes to take effect.<\/li>\n<\/ol>\n

    If you\u2019re unable to apply the above registry file, launch Windows in Safe Mode<\/a>\u00a0and try merging the file again.<\/p>\n

    This removes all the Defender-related policies from the registry.<\/p>\n

    (For more information, see the article Microsoft Defender: \u201cManaged by your administrator\u201d or \u201cYour IT administrator has limited access\u201d<\/a><\/em>)<\/p>\n

    \n

    Option 2: Delete the “Exclusions” manually<\/h3>\n
      \n
    1. Start Regedit.exe and go to the following key:\n
      HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender<\/pre>\n<\/li>\n
    2. Expand the “Windows Defender” key.<\/li>\n
    3. Right-click on the “Exclusions” subkey and choose Delete.<\/li>\n
    4. Exit the Registry Editor.<\/li>\n<\/ol>\n
      \nTo accomplish the above using command-line, run the following command from admin Command Prompt:<\/p>\n
      reg delete \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Exclusions\" \/f<\/pre>\n
      Press Enter.\n<\/p><\/div>\n
      Equivalent Group Policy setting<\/h4>\n
      Computer Configuration \u2192 Windows Components \u2192 Microsoft Defender Antivirus \u2192 Exclusions<\/pre>\n
      Set “Extension Exclusions”, “Path Exclusions”, and “Process Exclusions” to Not configured.<\/p>\n
      \n
      Option 3: Delete the “Exclusions” via Windows RE<\/h3>\n
      If the exclusions can’t be removed when Windows is running, you can boot into Windows RE and delete the exclusions.<\/p>\n
        \n
      1. From the sign-in screen in Windows 10\/11, press and hold the SHIFT<\/kbd> key on the keyboard.<\/li>\n
      2. With the SHIFT<\/kbd> key still pressed, click the Power button and then click Restart.<\/li>\n
      3. In the Recovery Options menu, click Troubleshoot, and then click Advanced Options.
        \n\"windows
        \n<\/li>\n
      4. Click Command Prompt.
        \n<\/li>\n
      5. Find out the drive letter of your Windows installation by typing bcdedit<\/code>. If Windows was installed on C:\\ drive, it might be assigned D:\\ in Windows RE. The output of the bcdedit<\/strong><\/code> command shows the Windows drive letter, as seen from Windows RE.\n
        Note: On my EFI-based system, the bcdedit output stated that the OS drive-letter is (E:\\<\/strong>)<\/em><\/p>\n
        \"bcdedut<\/p>\n<\/div>\n<\/li>\n
      6. Once you got the drive letter of your Windows installation (e.g., E:\\<\/strong><\/code> ), run the following commands:\n
        REG LOAD HKLM\\S2 E:\\windows\\system32\\config\\SOFTWARE<\/pre>\n
        REG DELETE \"HKLM\\S2\\Microsoft\\Windows Defender\\Exclusions\" \/F<\/pre>\n
        REG UNLOAD HKLM\\S2<\/pre>\n
        \"delete<\/p>\n
        Important:<\/strong> For each command, you should see the output “The operation completed successfully.<\/strong>”\n<\/li>\n<\/ol>\n
        \n
        Option 4: Install Malwarebytes and set it as the default AV provider (temporarily)<\/h3>\n
          \n
        1. Install Malwarebytes from https:\/\/www.malwarebytes.com\/<\/code> and run it.<\/li>\n
        2. In the Malwarebytes Settings dialog, click “Security.”<\/li>\n
        3. Enable “Always register Malwarebytes in the Windows Security Center” and wait 15 seconds or so. This turns off Defender real-time protection and sets Malwarebytes as the default antivirus provider.\n
          \"malwarebytes<\/li>\n
        4. Download “AdvancedRun” from Nirsoft.net, and run it.<\/li>\n
        5. From the AdvancedRun window, start C:\\Windows\\Regedit.exe<\/strong> as TrustedInstaller. See this article<\/a> for more information.
          \n\"advancedrun\n<\/li>\n
        6. From the Registry Editor window, delete the following key.\n
          HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths<\/pre>\n<\/li>\n
        7. Close Regedit.exe<\/li>\n
        8. Disable “Always register Malwarebytes in the Windows Security Center.”<\/li>\n
        9. Uninstall Malwarebytes (optional).<\/li>\n<\/ol>\n
          That’s it! The Defender exclusions policies are now removed. Exit Windows RE and boot into Windows.<\/p>\n","protected":false},"excerpt":{"rendered":"
          When you open Windows Security \u2192 Virus and Threat Protection\u00a0 \u2192 Manage Settings \u2192 Add or remove exclusions, you may be able to delete the exclusions by clicking on the “Remove” button. Also, the Remove-MpPreference PowerShell command may not help.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[8,869],"tags":[441,661],"class_list":["post-47041","post","type-post","status-publish","format-standard","hentry","category-windows-10","category-windows-11","tag-registry","tag-windows-defender"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":59671,"url":"https:\/\/www.winhelponline.com\/blog\/reset-exclusions-windows-defender\/","url_meta":{"origin":47041,"position":0},"title":"How to Bulk Reset Exclusions in Windows Defender","author":"Ramesh","date":"July 24, 2023","format":false,"excerpt":"In the aftermath of a malware attack, you often end up with unwanted exclusion entries in Microsoft Defender Antivirus. Exclusions may exist for a folder, file, file type, or process. These exclusions can be cleared by opening the Virus and Threat Protection page in Windows Security. Select each entry and\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"powershell reset exclusions","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/07\/defender-exclusions-clear-powershell.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/07\/defender-exclusions-clear-powershell.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/07\/defender-exclusions-clear-powershell.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/07\/defender-exclusions-clear-powershell.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":5125,"url":"https:\/\/www.winhelponline.com\/blog\/windows-defender-disabled-real-time-protection-virus\/","url_meta":{"origin":47041,"position":1},"title":"Microsoft Defender: “Managed by your administrator” or “Your IT administrator has limited access”","author":"Ramesh","date":"January 23, 2017","format":false,"excerpt":"In the aftermath of a malware attack, the Windows Defender Security settings page may show the message Some settings are managed by your organization\u00a0or This setting is managed by your administrator. The real-time protection and cloud-based protection options may remain disabled or grayed out. Here is what the Windows Defender\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"Microsoft Defender Antivirus group policy settings","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/windows-defender-gpedit-ui.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/windows-defender-gpedit-ui.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/windows-defender-gpedit-ui.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/windows-defender-gpedit-ui.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":17887,"url":"https:\/\/www.winhelponline.com\/blog\/windows-defender-identifies-same-threat-repeatedly\/","url_meta":{"origin":47041,"position":2},"title":"Windows Defender Shows the Same Threat Repeatedly. How to Clear the Protection History","author":"Ramesh","date":"August 14, 2020","format":false,"excerpt":"On some Windows 10 and 11 computers, Microsoft Defender Antivirus may repeatedly warn about the same threat, although you've taken the necessary action (remediated) on that threat. When you click \"Start actions\" after choosing \"Remove\", nothing happens. Windows Defender would keep showing that non-existent threat. Cause This is caused by\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"detectionhistory folder contents","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/08\/defender-detection-history-delete.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/08\/defender-detection-history-delete.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/08\/defender-detection-history-delete.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/08\/defender-detection-history-delete.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":31386,"url":"https:\/\/www.winhelponline.com\/blog\/windows-update-services-deleted-every-restart\/","url_meta":{"origin":47041,"position":3},"title":"Windows Update services are deleted at every restart","author":"Ramesh","date":"December 30, 2022","format":false,"excerpt":"After you restore the missing Windows Update, BITS, or the Update Orchestrator Service services using registry files, you find that the services vanish again after a restart. They don't appear in the Services MMC. Cause This issue happens if your computer is infected. Malware running as a service or scheduled\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"autoruns check virus total","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/12\/autoruns-check-virustotal.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":54263,"url":"https:\/\/www.winhelponline.com\/blog\/windows-script-host-error-run-vbs\/","url_meta":{"origin":47041,"position":4},"title":"Windows Script Host error in AppData\\Local\\Updates\\Run.vbs. The System cannot find the file specified","author":"Ramesh","date":"June 17, 2023","format":false,"excerpt":"When you login to your account,\u00a0you may see a Windows Script Host error similar to the following: Windows Script Host Script: C:\\Users\\{username}\\AppData\\Local\\Updates\\Run.vbs Line: 31 Char: 1 Error: The system cannot find the file specified. Code: 80070002 Source: (null) Additionally, on some systems, you may see a WindowsService.exe popup window that\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"windowsservice.exe malware","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/windowsservice-exe-pop-up.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/windowsservice-exe-pop-up.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/windowsservice-exe-pop-up.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/windowsservice-exe-pop-up.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":17759,"url":"https:\/\/www.winhelponline.com\/blog\/windows-defender-hostsfilehijack-alert-telemetry-block\/","url_meta":{"origin":47041,"position":5},"title":"Windows Defender “HostsFileHijack” alert appears if Telemetry is blocked","author":"Ramesh","date":"August 5, 2020","format":false,"excerpt":"Since July last week, Windows Defender started issuing Win32\/HostsFileHijack \"potentially unwanted behavior\" alerts if you had blocked Microsoft's Telemetry servers using the HOSTS file. Out of the SettingsModifier:Win32\/HostsFileHijack cases reported online, the earliest one was reported at the Microsoft Answers forums where the user stated: I'm getting a serious \"potentially\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"defender hostsfilehijack","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/08\/defender-hostsfilejihack-00.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/47041","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/comments?post=47041"}],"version-history":[{"count":0,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/47041\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/media?parent=47041"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/categories?post=47041"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/tags?post=47041"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}