Script to add an exclusion to Windows Defender may be simplified

[fdcastel]

This script to add an exclusion to Windows Defender seems overly complex

Already discussed here (DBeaver is built on Eclipse Platform).

Suggestion

Replace the current

$exclusions=@( `
 "C:\Program Files\DBeaver\dbeaver.exe"); `
 $existingExclusions=[Collections.Generic.HashSet[String]](Get-MpPreference).ExclusionProcess; `
 if($existingExclusions -eq $null) { $existingExclusions = New-Object Collections.Generic.HashSet[String] }; `
 $exclusionsToAdd=[Linq.Enumerable]::ToArray([Linq.Enumerable]::Where($exclusions,[Func[object,bool]]{param($ex)!$existingExclusions.Contains($ex)})); `
 if($exclusionsToAdd.Length -gt 0){ Add-MpPreference -ExclusionProcess $exclusionsToAdd }

With the simpler

Add-MpPreference -ExclusionProcess 'C:\Program Files\DBeaver\dbeaver.exe'

Rationale

I tested the simpler version and it seems that Add-MpPreference already does exactly the same work the current script does.

• It will APPEND the item to the list, not to REPLACE it.
• If the list doesn't exists, it will CREATE it.
• Tested on Windows 11 / Windows Powershell 5.1.

Community

• I understand suggesting an enhancement doesn't mandate anyone to implement it. Other contributors may consider this suggestion, or not, at their own convenience. The most efficient way to get it fixed is that I implement it myself and contribute it back as a good quality patch to the project.

[fdcastel]

I'm happy to contribute with a PR if the team agrees the suggestion is viable

[HannesWell]

Thank you for your interest in making this script simpler.
The reason it is that complex is that Add-MpPreference unfortunately doesn't check if an equal path is already excluded and adds the path again. At least that was the case when I implemented it that way.
At the same time one cannot check the existing exclusions without Admin-privileges (which makes sense from a security POV) and since we don't want to ask the user for Admin privileges multiple times it has to happen within the script.
Otherwise the list of exclusions would grow each time one triggers the exclusion again in the preferences, e.g. to be sure that an installation is really excluded.

If you know a better/shorter way to achieve that as well, it would be more than welcome. But I think that functionality is relevant.

[fdcastel]

Thank you for your interest in making this script simpler. The reason it is that complex is that Add-MpPreference unfortunately doesn't check if an equal path is already excluded and adds the path again.

This is awkward. This is NOT the behavior I observed:

# Windows Powershell 5.1 / Windows 11 / Admin rights
PS C:\> (Get-MpPreference).ExclusionProcess
C:\Program Files\DBeaver\dbeaver.exe
PS C:\> Add-MpPreference -ExclusionProcess 'C:\Program Files\DBeaver\dbeaver.exe'
PS C:\> Add-MpPreference -ExclusionProcess 'C:\Program Files\DBeaver\dbeaver.exe'
PS C:\> Add-MpPreference -ExclusionProcess 'C:\Program Files\DBEAVER\dbeaver.exe'
PS C:\> Add-MpPreference -ExclusionProcess 'C:\Program Files\DBeaver\DBEAVER.exe'
PS C:\> (Get-MpPreference).ExclusionProcess
C:\Program Files\DBeaver\dbeaver.exe

PS C:\> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      5.1.22621.4391
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.22621.4391
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

# Powershell Core 7.5 / Windows 11 / Admin rights
PS C:\> (Get-MpPreference).ExclusionProcess
C:\Program Files\DBeaver\dbeaver.exe
PS C:\> Add-MpPreference -ExclusionProcess 'C:\Program Files\DBeaver\dbeaver.exe'
PS C:\> Add-MpPreference -ExclusionProcess 'C:\Program Files\DBeaver\dbeaver.exe'
PS C:\> Add-MpPreference -ExclusionProcess 'C:\Program Files\DBEAVER\dbeaver.exe'
PS C:\> Add-MpPreference -ExclusionProcess 'C:\Program Files\DBeaver\DBEAVER.exe'
PS C:\> (Get-MpPreference).ExclusionProcess
C:\Program Files\DBeaver\dbeaver.exe

PS C:\> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      7.5.0
PSEdition                      Core
GitCommitId                    7.5.0
OS                             Microsoft Windows 10.0.22621
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

[HannesWell]

Thank you for your interest in making this script simpler. The reason it is that complex is that Add-MpPreference unfortunately doesn't check if an equal path is already excluded and adds the path again.

This is awkward. This is NOT the behavior I observed:

Surprisingly for me I can confirm your observation. But I'm relatively sure, that when developing this exclusion, it was not skipping duplicates and I would have also preferred to keep it simple. Maybe this changed in Windows, although I wouldn't have expected that. Anyways, it looks like this can be simpler now.

Are you interested in providing a PR to simplify this?

[fdcastel]

@HannesWell Sure, I would love to help! However, I was under the impression that @IamLRBA had already done the job?