diff --git a/windows/client-management/mdm/vpnv2-csp.md b/windows/client-management/mdm/vpnv2-csp.md index e4a2c9975f..921891e030 100644 --- a/windows/client-management/mdm/vpnv2-csp.md +++ b/windows/client-management/mdm/vpnv2-csp.md @@ -30,8 +30,8 @@ Here are the requirements for this CSP: The XSDs for all EAP methods are shipped in the box and can be found at the following locations: -- `C:\\Windows\\schemas\\EAPHost` -- `C:\\Windows\\schemas\\EAPMethods` +- `C:\Windows\schemas\EAPHost` +- `C:\Windows\schemas\EAPMethods` The following shows the VPNv2 configuration service provider in tree format. diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md index 3108c5ea6b..3ce1ffde39 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md @@ -34,10 +34,10 @@ Do not define exclusions for the folder locations, file extensions, and processe | Folder locations | File extensions | Processes | |:--|:--|:--| -| `%systemdrive%`
`C:`
`C:\`
`C:\*`
`%ProgramFiles%\Java`
`C:\Program Files\Java`
`%ProgramFiles%\Contoso\`
`C:\Program Files\Contoso\`
`%ProgramFiles(x86)%\Contoso\`
`C:\Program Files (x86)\Contoso\`
`C:\Temp`
`C:\Temp\`
`C:\Temp\*`
`C:\Users\`
`C:\Users\*`
`C:\Users\\AppData\Local\Temp\`
`C:\Users\\AppData\LocalLow\Temp\`
`C:\Users\\AppData\Roaming\Temp\`
`%Windir%\Prefetch`
`C:\Windows\Prefetch`
`C:\Windows\Prefetch\`
`C:\Windows\Prefetch\*`
`%Windir%\System32\Spool`
`C:\Windows\System32\Spool`
`C:\Windows\System32\CatRoot2`
`%Windir%\Temp`
`C:\Windows\Temp`
`C:\Windows\Temp\`
`C:\Windows\Temp\*` | `.7zip`
`.bat`
`.bin`
`.cab`
`.cmd`
`.com`
`.cpl`
`.dll`
`.exe`
`.fla`
`.gif`
`.gz`
`.hta`
`.inf`
`.java`
`.jar`
`.job`
`.jpeg`
`.jpg`
`.js`
`.ko`
`.ko.gz`
`.msi`
`.ocx`
`.png`
`.ps1`
`.py`
`.rar`
`.reg`
`.scr`
`.sys`
`.tar`
`.tmp`
`.url`
`.vbe`
`.vbs`
`.wsf`
`.zip` | `AcroRd32.exe`
`bitsadmin.exe`
`excel.exe`
`iexplore.exe`
`java.exe`
`outlook.exe`
`psexec.exe`
`powerpnt.exe`
`powershell.exe`
`schtasks.exe`
`svchost.exe`
`wmic.exe`
`winword.exe`
`wuauclt.exe`
`addinprocess.exe`
`addinprocess32.exe`
`addinutil.exe`
`bash.exe`
`bginfo.exe`[1]
`cdb.exe`
`csi.exe`
`dbghost.exe`
`dbgsvc.exe`
`dnx.exe`
`fsi.exe`
`fsiAnyCpu.exe`
`kd.exe`
`ntkd.exe`
`lxssmanager.dll`
`msbuild.exe`[2]
`mshta.exe`
`ntsd.exe`
`rcsi.exe`
`system.management.automation.dll`
`windbg.exe` | +| `%systemdrive%`
`C:`
`C:\`
`C:\*`
`%ProgramFiles%\Java`
`C:\Program Files\Java`
`%ProgramFiles%\Contoso\`
`C:\Program Files\Contoso\`
`%ProgramFiles(x86)%\Contoso\`
`C:\Program Files (x86)\Contoso\`
`C:\Temp`
`C:\Temp\`
`C:\Temp\*`
`C:\Users\`
`C:\Users\*`
`C:\Users\\AppData\Local\Temp\`
`C:\Users\\AppData\LocalLow\Temp\`
`C:\Users\\AppData\Roaming\Temp\`
`%Windir%\Prefetch`
`C:\Windows\Prefetch`
`C:\Windows\Prefetch\`
`C:\Windows\Prefetch\*`
`%Windir%\System32\Spool`
`C:\Windows\System32\Spool`
`C:\Windows\System32\CatRoot2`
`%Windir%\Temp`
`C:\Windows\Temp`
`C:\Windows\Temp\`
`C:\Windows\Temp\*` | `.7z`
`.bat`
`.bin`
`.cab`
`.cmd`
`.com`
`.cpl`
`.dll`
`.exe`
`.fla`
`.gif`
`.gz`
`.hta`
`.inf`
`.java`
`.jar`
`.job`
`.jpeg`
`.jpg`
`.js`
`.ko`
`.ko.gz`
`.msi`
`.ocx`
`.png`
`.ps1`
`.py`
`.rar`
`.reg`
`.scr`
`.sys`
`.tar`
`.tmp`
`.url`
`.vbe`
`.vbs`
`.wsf`
`.zip` | `AcroRd32.exe`
`bitsadmin.exe`
`excel.exe`
`iexplore.exe`
`java.exe`
`outlook.exe`
`psexec.exe`
`powerpnt.exe`
`powershell.exe`
`schtasks.exe`
`svchost.exe`
`wmic.exe`
`winword.exe`
`wuauclt.exe`
`addinprocess.exe`
`addinprocess32.exe`
`addinutil.exe`
`bash.exe`
`bginfo.exe`[1]
`cdb.exe`
`csi.exe`
`dbghost.exe`
`dbgsvc.exe`
`dnx.exe`
`fsi.exe`
`fsiAnyCpu.exe`
`kd.exe`
`ntkd.exe`
`lxssmanager.dll`
`msbuild.exe`[2]
`mshta.exe`
`ntsd.exe`
`rcsi.exe`
`system.management.automation.dll`
`windbg.exe` | ->[!NOTE] -> You can chose to exclude file types, such as `.gif`, `.jpg`, `.jpeg`, or `.png` if your environment has a modern, up-to-date software with a strict update policy to handle any vulnerabilities. +> [!NOTE] +> You can choose to exclude file types, such as `.gif`, `.jpg`, `.jpeg`, or `.png` if your environment has a modern, up-to-date software with a strict update policy to handle any vulnerabilities. ## Using just the file name in the exclusion list diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md index 72b9e21580..ff54f8daf2 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md @@ -31,7 +31,8 @@ ms.technology: mde You can exclude certain files from Microsoft Defender Antivirus scans by modifying exclusion lists. **Generally, you shouldn't need to apply exclusions**. Microsoft Defender Antivirus includes many automatic exclusions based on known operating system behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations. -**Note**: Exclusions apply to Potentially Unwanted Apps (PUA) detections as well. +> [!NOTE] +> Exclusions apply to Potentially Unwanted Apps (PUA) detections as well. > [!NOTE] > Automatic exclusions apply only to Windows Server 2016 and above. These exclusions are not visible in the Windows Security app and in PowerShell. @@ -40,7 +41,7 @@ This article describes how to configure exclusion lists for the files and folde | Exclusion | Examples | Exclusion list | |:---|:---|:---| -|Any file with a specific extension | All files with the specified extension, anywhere on the machine.
Valid syntax: `.test` and `test` | Extension exclusions | +|Any file with a specific extension | All files with the specified extension, anywhere on the machine.

Valid syntax: `.test` and `test` | Extension exclusions | |Any file under a specific folder | All files under the `c:\test\sample` folder | File and folder exclusions | | A specific file in a specific folder | The file `c:\sample\sample.test` only | File and folder exclusions | | A specific process | The executable file `c:\test\process.exe` | File and folder exclusions | @@ -92,20 +93,18 @@ See [How to create and deploy antimalware policies: Exclusion settings](/configm 4. Open the **Path Exclusions** setting for editing, and add your exclusions. - - Set the option to **Enabled**. - - Under the **Options** section, click **Show...**. - - Specify each folder on its own line under the **Value name** column. - - If you are specifying a file, ensure you enter a fully qualified path to the file, including the drive letter, folder path, filename, and extension. Enter **0** in the **Value** column. + 1. Set the option to **Enabled**. + 1. Under the **Options** section, click **Show**. + 1. Specify each folder on its own line under the **Value name** column. + 1. If you are specifying a file, ensure that you enter a fully qualified path to the file, including the drive letter, folder path, file name, and extension. Enter **0** in the **Value** column. 5. Choose **OK**. - ![The Group Policy setting for file and folder exclusions](images/defender/wdav-path-exclusions.png) - 6. Open the **Extension Exclusions** setting for editing and add your exclusions. - - Set the option to **Enabled**. - - Under the **Options** section, select **Show...**. - - Enter each file extension on its own line under the **Value name** column. Enter **0** in the **Value** column. + 1. Set the option to **Enabled**. + 1. Under the **Options** section, select **Show**. + 1. Enter each file extension on its own line under the **Value name** column. Enter **0** in the **Value** column. 7. Choose **OK**. @@ -139,7 +138,7 @@ The following are allowed as the ``: > [!IMPORTANT] > If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list. -For example, the following code snippet would cause Microsoft Defender AV scans to exclude any file with the `.test` file extension: +For example, the following code snippet would cause Microsoft Defender Antivirus scans to exclude any file with the `.test` file extension: ```PowerShell Add-MpPreference -ExclusionExtension ".test" @@ -183,9 +182,9 @@ The following table describes how the wildcards can be used and provides some ex |Wildcard |Examples | |:---------|:---------| -|`*` (asterisk)

In **file name and file extension inclusions**, the asterisk replaces any number of characters, and only applies to files in the last folder defined in the argument.

In **folder exclusions**, the asterisk replaces a single folder. Use multiple `*` with folder slashes `\` to indicate multiple nested folders. After matching the number of wild carded and named folders, all subfolders are also included. | `C:\MyData\*.txt` would include `C:\MyData\notes.txt`

`C:\somepath\*\Data` would include any file in `C:\somepath\Archives\Data and its subfolders` and `C:\somepath\Authorized\Data and its subfolders`

`C:\Serv\*\*\Backup` would include any file in `C:\Serv\Primary\Denied\Backup and its subfolders` and `C:\Serv\Secondary\Allowed\Backup and its subfolders` | -|`?` (question mark)

In **file name and file extension inclusions**, the question mark replaces a single character, and only applies to files in the last folder defined in the argument.

In **folder exclusions**, the question mark replaces a single character in a folder name. After matching the number of wild carded and named folders, all subfolders are also included. |`C:\MyData\my?` would include `C:\MyData\my1.zip`

`C:\somepath\?\Data` would include any file in `C:\somepath\P\Data` and its subfolders

`C:\somepath\test0?\Data` would include any file in `C:\somepath\test01\Data` and its subfolders | -|Environment variables

The defined variable is populated as a path when the exclusion is evaluated. |`%ALLUSERSPROFILE%\CustomLogFiles` would include `C:\ProgramData\CustomLogFiles\Folder1\file1.txt` | +|`*` (asterisk)

In **file name and file extension inclusions**, the asterisk replaces any number of characters, and only applies to files in the last folder defined in the argument.

In **folder exclusions**, the asterisk replaces a single folder. Use multiple `*` with folder slashes `\` to indicate multiple nested folders. After matching the number of wild carded and named folders, all subfolders are also included. | `C:\MyData\*.txt` includes `C:\MyData\notes.txt`

`C:\somepath\*\Data` includes any file in `C:\somepath\Archives\Data` and its subfolders, and `C:\somepath\Authorized\Data` and its subfolders

`C:\Serv\*\*\Backup` includes any file in `C:\Serv\Primary\Denied\Backup` and its subfolders and `C:\Serv\Secondary\Allowed\Backup` and its subfolders | +|`?` (question mark)

In **file name and file extension inclusions**, the question mark replaces a single character, and only applies to files in the last folder defined in the argument.

In **folder exclusions**, the question mark replaces a single character in a folder name. After matching the number of wild carded and named folders, all subfolders are also included. |`C:\MyData\my?.zip` includes `C:\MyData\my1.zip`

`C:\somepath\?\Data` includes any file in `C:\somepath\P\Data` and its subfolders

`C:\somepath\test0?\Data` would include any file in `C:\somepath\test01\Data` and its subfolders | +|Environment variables

The defined variable is populated as a path when the exclusion is evaluated. |`%ALLUSERSPROFILE%\CustomLogFiles` would include `C:\ProgramData\CustomLogFiles\Folder1\file1.txt` | > [!IMPORTANT] @@ -360,4 +359,4 @@ You can also copy the string into a blank text file and attempt to save it with - [Configure and validate exclusions in Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) - [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md) - [Configure Microsoft Defender Antivirus exclusions on Windows Server](configure-server-exclusions-microsoft-defender-antivirus.md) -- [Common mistakes to avoid when defining exclusions](common-exclusion-mistakes-microsoft-defender-antivirus.md) \ No newline at end of file +- [Common mistakes to avoid when defining exclusions](common-exclusion-mistakes-microsoft-defender-antivirus.md)