Find Defender exclusions
Documentation: Microsoft Learn
Get-MpPreference returns the local Defender configuration, and the projection pulls the three exclusion collections covering file paths, process images, and extensions.
The script
Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
Get-MpPreference | Select-Object ExclusionPath,ExclusionProcess,ExclusionExtension- Stage 1Get-MpPreference
Positional values or no named parameters - Stage 2Select-Object
Positional values or no named parameters
How it works
Get-MpPreference returns the local Defender configuration, and the projection pulls the three exclusion collections covering file paths, process images, and extensions.
Adapting it
Join each array through a calculated property before exporting, otherwise the CSV columns hold type names in place of the exclusions the review was supposed to examine.
Requirements
Defender present; reading preferences generally works without elevation, which is itself part of the concern.
If the result is unexpected
Defender exclusion output looks empty or differs from managed policy.
The local view, effective management policy and product availability can differ.
- Confirm Defender is the active product and compare local exclusion properties with the management policy.
Validate the result
The report distinguishes unavailable data from a successful query with no exclusions.
Keep the check reliable
Identify the policy owner before changing managed exclusions.
