Windows Defender: Although folder excluded files are scanned

%3CLINGO-SUB%20id%3D%22lingo-sub-2597576%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20Defender%3A%20Although%20folder%20exclude%20files%20are%20scanned%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2597576%22%20slang%3D%22en-US%22%3ELooks%20like%20above%20scan%20message%20is%20from%20a%20previous%20date.%20But%20I%20have%20them%20also%20afterwards%3A%3CBR%20%2F%3E2021-07-28T05%3A14%3A04.851Z%20%5BMini-filter%5D%20Unsuccessful%20scan%20status%3A%20%5CDevice%5CHarddiskVolume6%5Cdatabase%5Capplication%5Cdata%5Csubfolder%5C00000001000001C10000004F.%20Process%3A%20(unknown)%2C%20Status%3A%200xc000004b%2C%20State%3A%200%2C%20ScanRequest%20%2328198043%2C%20FileId%3A%200x29fa000000018773%2C%20Reason%3A%20OnClose%2C%20IoStatusBlockForNewFile%3A%200xffffffff%2C%20DesiredAccess%3A0x0%2C%20FileAttributes%3A0x20%2C%20ScanAttributes%3A0x10%2C%20AccessStateFlags%3A0x801%2C%20BackingFileInfo%3A%200x0%2C%200x0%2C%200x0%3A0%5C0x0%3A0%3CBR%20%2F%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2618298%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20Defender%3A%20Although%20folder%20exclude%20files%20are%20scanned%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2618298%22%20slang%3D%22en-US%22%3E%3CP%3ESurprising%20that%20a%20simple%20question%20like%20this%3A%3CBR%20%2F%3E%3CSTRONG%3EAre%20the%20files%20in%20the%20folder%20scanned%3F%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3Eis%20not%20answered%20by%20somebody%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2597529%22%20slang%3D%22en-US%22%3EWindows%20Defender%3A%20Although%20folder%20excluded%20files%20are%20scanned%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2597529%22%20slang%3D%22en-US%22%3E%3CP%3EHi%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHaving%20Windows%20Defender%20running%20on%20a%20server%202016.%3C%2FP%3E%3CP%3EExcluded%20a%20folder%3A%20s%3A%5Cdatabase%5Capplication%5Cdata%3C%2FP%3E%3CP%3EVerified%20in%20the%20logfile%20C%3A%5CProgramData%5CMicrosoft%5CWindows%26nbsp%3BDefender%5CSupport%3C%2FP%3E%3CP%3Ethe%20exclusion%3A%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-applescript%22%3E%3CCODE%3E2021-07-22T00%3A22%3A08.983Z%20%5BExclusion%5D%20s%3A%5Cdatabase%5Capplication%5Cdata%20-%26gt%3B%20%5CDevice%5CHarddiskVolume6%5Cdatabase%5Capplication%5Cdata%3C%2FCODE%3E%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESo%20far%20so%20good.%3C%2FP%3E%3CP%3EBut%20found%20afterwards%20log-entries%20like%3A%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-applescript%22%3E%3CCODE%3E2021-07-28T05%3A14%3A04.851Z%20%5BMini-filter%5D%20Unsuccessful%20scan%20status%3A%20%5CDevice%5CHarddiskVolume6%5Cdatabase%5Capplication%5Cdata%5Csubfolder%5C00000001000001A300000026.%20Process%3A%20(unknown)%2C%20Status%3A%200xc000004b%2C%20State%3A%200%2C%20ScanRequest%20%23382525762%2C%20FileId%3A%20%0A%0A0x27bb0000000079e4%2C%20Reason%3A%20OnClose%2C%20IoStatusBlockForNewFile%3A%200xffffffff%2C%20DesiredAccess%3A0x0%2C%20FileAttributes%3A0x20%2C%20ScanAttributes%3A0x10%2C%20AccessStateFlags%3A0x801%2C%20BackingFileInfo%3A%200x0%2C%200x0%2C%200x0%3A0%5C0x0%3A0%3C%2FCODE%3E%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EDoes%20Windows%20Defender%20scans%20the%20file%20although%20the%20parent%20folder%20is%20excluded%3F%3C%2FP%3E%3CP%3EIf%20yes%20what%20can%20I%20do%20to%20avoid%20scanning%20of%20the%20files%20in%20the%20folder%20s%3A%5Cdatabase%5Capplication%5Cdata%20and%20it's%20subfolders%3F%3C%2FP%3E%3CP%3EThanks%20for%20info%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CDIV%20class%3D%22lia-message-body%20lia-component-message-view-widget-body%20lia-component-body-signature-highlight-escalation%20lia-component-message-view-widget-body-signature-highlight-escalation%22%3E%3CDIV%20class%3D%22lia-message-body-content%22%3EIs%20my%20interpretation%20of%20the%20logfile%20correct%3A%3C%2FDIV%3E%3CDIV%20class%3D%22lia-message-body-content%22%3EWindow%20Defender%20scans%20the%20file%3F%3C%2FDIV%3E%3C%2FDIV%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Senior Member

Hi

 

Having Windows Defender running on a server 2016.

Excluded a folder: s:\database\application\data

Verified in the logfile C:\ProgramData\Microsoft\Windows Defender\Support

the exclusion:

2021-07-22T00:22:08.983Z [Exclusion] s:\database\application\data -> \Device\HarddiskVolume6\database\application\data

 

So far so good.

But found afterwards log-entries like:

2021-07-28T05:14:04.851Z [Mini-filter] Unsuccessful scan status: \Device\HarddiskVolume6\database\application\data\subfolder\00000001000001A300000026. Process: (unknown), Status: 0xc000004b, State: 0, ScanRequest #382525762, FileId: 

0x27bb0000000079e4, Reason: OnClose, IoStatusBlockForNewFile: 0xffffffff, DesiredAccess:0x0, FileAttributes:0x20, ScanAttributes:0x10, AccessStateFlags:0x801, BackingFileInfo: 0x0, 0x0, 0x0:0\0x0:0

 

Does Windows Defender scans the file although the parent folder is excluded?

If yes what can I do to avoid scanning of the files in the folder s:\database\application\data and it's subfolders?

Thanks for info

 

 

Is my interpretation of the logfile correct:
Window Defender scans the file?

 

0 Replies
www.000webhost.com