Skip to main content

How do I remove Managed AV "host" exclusions

Alan Bishop
  • Updated

Exclusions set on a host cannot be cleared by the Huntress agent, so if you see a "Source: Host" exclusion making your agent non-compliant in Managed AV (Microsoft Defender) you'll need to manually remove them to become compliant again.

mceclip5.png

 

Open up Windows Security Center (click on the start button and type "Windows Security Center")

Click on Virus & threat protection

mceclip0.png

Click on Manage Settings

mceclip1.png

Scroll down and click on Add or remove exclusions

mceclip2.png

For each exclusion you wish to remove move your mouse over the exclusion until a down arrow appears,  click on that, then click the Remove button that appears

mceclip4.png

 

Using PowerShell:

# set exclusions to default
$pathExclusions = Get-MpPreference | select ExclusionPath 
foreach ($exclusion in $pathExclusions) {
    if ($exclusion.ExclusionPath -ne $null) {
        Remove-MpPreference -ExclusionPath $exclusion.ExclusionPath
    }
}
$extensionExclusion = Get-MpPreference | select ExclusionExtension 
foreach ($exclusion in $extensionExclusion) {
    if ($exclusion.ExclusionExtension -ne $null) {
        Remove-MpPreference -ExclusionExtension $exclusion.ExclusionExtension
    }
}
$processExclusions = Get-MpPreference | select ExclusionProcess
foreach ($exclusion in $processExclusions) {
    if ($exclusion.ExclusionProcess -ne $null) {
        Remove-MpPreference -ExclusionProcess $exclusion.ExclusionProcess
    }
}

Comments

3 comments

Date Votes
  • Thomas Bray

    Question - "Exclusions set on a host cannot be cleared by the Huntress agent..." - is this a decided-upon limitation/policy of the Huntress agent, or a limitation by Microsoft regarding the management of Defender exclusions created by different users on the system?

    1
  • Alan Bishop

    Thanks for the great question Thomas! It was a policy that Huntress decided upon so that we don't clear any exclusions the partner had set previously. 

    0
  • Phil Ellis

    Huntress should add an option to override existing exclusions, it's hardly managed or enforced if you allow existing exceptions to remain and they can only be remediated by manually connecting to the device and removing them in the GUI.

    0

Please sign in to leave a comment.

Related articles