How to exclude restic.exe from Defender?

Getting Help
1

I actually have Defender virus scanning turned off. But to future proof my backup script, I wonder how to reliably exclude Restic from Defender.

Is the following enough?

> Add-MpPreference -ExclusionProcess restic.exe

Or do I need to use the full path as reported by the Task Manager?

> Add-MpPreference -ExclusionProcess "C:\Users\Felix\AppData\Local\Microsoft\WinGet\Packages\restic.restic_Microsoft.Winget.Source_8wekyb3d8bbwe\restic_0.18.1_windows_amd64.exe"

(which changes with every upgrade)

2

The docs are a little vague, but I think the answer is “the process name needs to match”.

So if it shows up in task manager as restic.exe I think the first one will work.
If it shows up as restic_0.18.1_windows_amd64.exe then you would need a variation on the second one, but without the full path. So:

> Add-MpPreference -ExclusionProcess "restic_0.18.1_windows_amd64.exe"

Based on google (don’t have a windows machine handy to check) the process name should be the name of the executable, as shown under the “details” tab of task manager. Which would be the second one, with the version in…

Unfortunately the Add-MpPreference -ExclusionProcess cmdlet doesn’t seem to support wildcards, so I can’t think of a nice fix here.

3

Thank you for checking!

restic.exe is actually a symbolic link, accoring to .LinkType. I now added this to the top of my backup script.

# Follow symlink and exclude full path from Windows Defender:
$Restic = (Get-Item (Get-Command restic.exe).Path).Target
Add-MpPreference -ExclusionProcess $Restic

Then there is no need to remember to exclude Restic from Windows Defender in case I set up the system anew. I run the backup script with pwsh.exe from WSL2.

1 Like