{"id":59671,"date":"2023-07-24T11:39:52","date_gmt":"2023-07-24T06:09:52","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=59671"},"modified":"2023-07-24T11:48:20","modified_gmt":"2023-07-24T06:18:20","slug":"reset-exclusions-windows-defender","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/reset-exclusions-windows-defender\/","title":{"rendered":"How to Bulk Reset Exclusions in Windows Defender"},"content":{"rendered":"

In the aftermath of a malware attack, you often end up with unwanted exclusion entries in Microsoft Defender Antivirus. Exclusions may exist for a folder, file, file type, or process. These exclusions can be cleared by opening the Virus and Threat Protection page in Windows Security.<\/p>\n

\"defender<\/p>\n

Select each entry and click on the “Remove” button. However, if there are many exclusion entries and you want to clear all of them automatically<\/strong>, you can use PowerShell.<\/p>\n

Clear Exclusions and Allowed Threats in Defender<\/h2>\n

Use the following PowerShell code to quickly clear the exclusions and allowed threats (if any).<\/p>\n

Open PowerShell (admin). Please copy the following commands and paste them into the PowerShell window.<\/p>\n

$Paths=(Get-MpPreference).ExclusionPath\nforeach ($Path in $Paths) { Remove-MpPreference -ExclusionPath $Path -Verbose}\n$Extensions=(Get-MpPreference).ExclusionExtension\nforeach ($Extension in $Extensions) { Remove-MpPreference -ExclusionExtension $Extension -Verbose}\n$Processes=(Get-MpPreference).ExclusionProcess\nforeach ($Process in $Processes) { Remove-MpPreference -ExclusionProcess $Process -Verbose}\n$ThreatIds = (Get-MpPreference).ThreatIDDefaultAction_Ids\nForeach ($ThreatId in $ThreatIds) { Remove-MpPreference -ThreatIDDefaultAction_Ids $ThreatId -Verbose }\n<\/pre>\n
\"powershell<\/p>\n
The above code snippet clears all the exclusions and also the allowed threats. Note that it doesn’t clear exclusions configured via group policy. Also, the above code snippet doesn’t remove the exclusion entries for Controlled folder access<\/a>, as they’re stored separately.<\/em><\/p>\n
If the above PowerShell code can’t remove the exclusions, it may be because the Exclusions are configured via GPO or registry-based policies. In that case, see the article Fix: Cannot Delete Microsoft Defender Exclusions<\/a> to clear them en masse.<\/p>\n
More Information<\/h3>\n
The Microsoft Defender antivirus exclusions are stored in the following registry key:<\/p>\n
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions<\/pre>\n
And the allowed threats are stored in the following key:<\/p>\n
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Defender\\Threats<\/pre>\n
See also: Accidentally Allowed a Threat in Windows Defender. What to do now?<\/a><\/em><\/p>\n
These two keys can’t be modified directly when Microsoft Defender Antivirus is running. However, the above PowerShell code can clear them.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the aftermath of a malware attack, you often end up with unwanted exclusion entries in Microsoft Defender Antivirus. Exclusions may exist for a folder, file, file type, or process. These exclusions can be cleared by opening the Virus and Threat Protection page in Windows Security.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[8,869],"tags":[396,661,958],"class_list":["post-59671","post","type-post","status-publish","format-standard","hentry","category-windows-10","category-windows-11","tag-powershell","tag-windows-defender","tag-windows-security"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":17887,"url":"https:\/\/www.winhelponline.com\/blog\/windows-defender-identifies-same-threat-repeatedly\/","url_meta":{"origin":59671,"position":0},"title":"Windows Defender Shows the Same Threat Repeatedly. How to Clear the Protection History","author":"Ramesh","date":"August 14, 2020","format":false,"excerpt":"On some Windows 10 and 11 computers, Microsoft Defender Antivirus may repeatedly warn about the same threat, although you've taken the necessary action (remediated) on that threat. When you click \"Start actions\" after choosing \"Remove\", nothing happens. Windows Defender would keep showing that non-existent threat. Cause This is caused by\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"detectionhistory folder contents","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/08\/defender-detection-history-delete.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/08\/defender-detection-history-delete.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/08\/defender-detection-history-delete.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/08\/defender-detection-history-delete.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":47041,"url":"https:\/\/www.winhelponline.com\/blog\/cant-delete-defender-exclusions\/","url_meta":{"origin":59671,"position":1},"title":"Fix: Cannot Delete Microsoft Defender Exclusions","author":"Ramesh","date":"May 19, 2023","format":false,"excerpt":"When you open Windows Security \u2192 Virus and Threat Protection\u00a0 \u2192 Manage Settings \u2192 Add or remove exclusions, you may be able to delete the exclusions by clicking on the \"Remove\" button. Also, the Remove-MpPreference PowerShell command may not help. RELATED: How to Bulk Reset Exclusions in Windows Defender Cause\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"malwarebytes register security center","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/05\/malwarebytes-enable-security-center.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/05\/malwarebytes-enable-security-center.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/05\/malwarebytes-enable-security-center.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/05\/malwarebytes-enable-security-center.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":45734,"url":"https:\/\/www.winhelponline.com\/blog\/defender-accidentally-allowed-a-threat\/","url_meta":{"origin":59671,"position":2},"title":"Accidentally Allowed a Threat in Windows Defender. What to do now?","author":"Ramesh","date":"May 13, 2023","format":false,"excerpt":"When Microsoft Defender Antivirus finds a virus, it asks you what action to take on the threat. The options are \"Remove\", \"Quarantine\", and \"Allow on device\". You may wonder: What happens if you've accidentally clicked \"Allow\" instead of \"Remove\"? What happens to the \"allowed\" threat? Will Microsoft Defender Antivirus redetect\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"Defender Allowed Threats reset","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/05\/defender-allowed-threats-clear-1.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":17759,"url":"https:\/\/www.winhelponline.com\/blog\/windows-defender-hostsfilehijack-alert-telemetry-block\/","url_meta":{"origin":59671,"position":3},"title":"Windows Defender “HostsFileHijack” alert appears if Telemetry is blocked","author":"Ramesh","date":"August 5, 2020","format":false,"excerpt":"Since July last week, Windows Defender started issuing Win32\/HostsFileHijack \"potentially unwanted behavior\" alerts if you had blocked Microsoft's Telemetry servers using the HOSTS file. Out of the SettingsModifier:Win32\/HostsFileHijack cases reported online, the earliest one was reported at the Microsoft Answers forums where the user stated: I'm getting a serious \"potentially\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"defender hostsfilehijack","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/08\/defender-hostsfilejihack-00.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":31386,"url":"https:\/\/www.winhelponline.com\/blog\/windows-update-services-deleted-every-restart\/","url_meta":{"origin":59671,"position":4},"title":"Windows Update services are deleted at every restart","author":"Ramesh","date":"December 30, 2022","format":false,"excerpt":"After you restore the missing Windows Update, BITS, or the Update Orchestrator Service services using registry files, you find that the services vanish again after a restart. They don't appear in the Services MMC. Cause This issue happens if your computer is infected. Malware running as a service or scheduled\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"autoruns check virus total","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/12\/autoruns-check-virustotal.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":54263,"url":"https:\/\/www.winhelponline.com\/blog\/windows-script-host-error-run-vbs\/","url_meta":{"origin":59671,"position":5},"title":"Windows Script Host error in AppData\\Local\\Updates\\Run.vbs. The System cannot find the file specified","author":"Ramesh","date":"June 17, 2023","format":false,"excerpt":"When you login to your account,\u00a0you may see a Windows Script Host error similar to the following: Windows Script Host Script: C:\\Users\\{username}\\AppData\\Local\\Updates\\Run.vbs Line: 31 Char: 1 Error: The system cannot find the file specified. Code: 80070002 Source: (null) Additionally, on some systems, you may see a WindowsService.exe popup window that\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"windowsservice.exe malware","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/windowsservice-exe-pop-up.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/windowsservice-exe-pop-up.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/windowsservice-exe-pop-up.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/windowsservice-exe-pop-up.png?resize=700%2C400&ssl=1 2x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/59671","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/comments?post=59671"}],"version-history":[{"count":0,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/59671\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/media?parent=59671"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/categories?post=59671"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/tags?post=59671"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}