none
Add Exclusions to Windows Defender RRS feed

Answers

All replies

  • Sunday, April 14, 2019 2:24 PM
  • With WMI (MSFT_MpPreference)

    (tested with Add method on Windows 10, must be Admin)

    Sunday, April 14, 2019 2:48 PM
  • what do you mean WMI

    idk what to do

    can you give me a code or somthing?

    Sunday, April 14, 2019 3:44 PM
  • You can use WMI Code Creator to generate some parts of the code

    Test by adding 2 directories  "e:\test" and  "e:\test1" to exclusions =>

    string sComputerID = null;
    try
    {
        ManagementObjectSearcher searcher = new ManagementObjectSearcher("root\\Microsoft\\Windows\\Defender", "SELECT * FROM MSFT_MpPreference");
        foreach (ManagementObject queryObj in searcher.Get())
        {
            Console.WriteLine("-----------------------------------");
            Console.WriteLine("MSFT_MpPreference instance");
            Console.WriteLine("-----------------------------------");                   
            sComputerID = queryObj["ComputerID"].ToString();
            Console.WriteLine("ComputerID: {0}", sComputerID);
    
            if (queryObj["ExclusionPath"] == null)
                Console.WriteLine("ExclusionPath: {0}", queryObj["ExclusionPath"]);
            else
            {
                string[] arrExclusionPath = (string[])(queryObj["ExclusionPath"]);
                foreach (string arrValue in arrExclusionPath)
                {
                    Console.WriteLine("ExclusionPath: {0}", arrValue);
                }
            }
        }
    }
    catch (ManagementException ex)
    {
        MessageBox.Show("An error occurred while querying for WMI data: " + ex.Message);
    }
    
    try
    {
        string sPath = "MSFT_MpPreference.ComputerID='" + sComputerID + "'";                
        ManagementObject classInstance = new ManagementObject("root\\Microsoft\\Windows\\Defender",
           sPath,
           null);
    
        ManagementBaseObject inParams = classInstance.GetMethodParameters("Add");
    
        string[] arrExclusionPath = new string[2];
        arrExclusionPath[0] = "e:\\test";
        arrExclusionPath[1] = "e:\\test1";
        inParams["ExclusionPath"] = arrExclusionPath;
    
        ManagementBaseObject outParams = classInstance.InvokeMethod("Add", inParams, null);               
    }
    catch (ManagementException ex)
    {
        MessageBox.Show("An error occurred while trying to execute the WMI method: " + ex.Message);
    }
    

     
    Sunday, April 14, 2019 5:03 PM
  • What does this error means what should do:

    Sunday, April 14, 2019 5:05 PM
  • why do i get this error:

    Sunday, April 14, 2019 5:21 PM
  • If you type "ManagementObjectSearcher" on Google, you get the MSDN page where it says : Namespace : System.Management

    So add a reference to System.Management

    add at beginning :

    using System.Management;

    Sunday, April 14, 2019 5:26 PM
  • What does this error mean

    It means that the variable "reg" is null. Therefore, you cannot call GetValue on it. The reason for the variable to be null is that the preceding OpenSubkey could not open the sub key. Most likely the subkey doesn't exist in the computer where you are running the code..
    Tuesday, April 23, 2019 3:57 PM
    Moderator