1

I'm using Azure's Batch services to unzip very large zip files before processing the unzipped files then deleting them. Unfortunately Windows Defender, which is preinstalled on the Azure VM's I'm using, will lock certain files so they can't be deleted - I imagine it's scanning them for viruses. I know it's Windows Defender locking the files as I ran a process monitor on the VM and isolated the process.

I've tried stopping Windows Defender as part of the batch job's preparation tasks but despite setting the elevation levels to Admin I still have no luck - access is denied.

Any help in disabling Windows Defender on an Azure VM via Batch services would be appreciated.

  • Have you tried to add the files to the list of files and folders that Windows Defender will ignore (i.e. not scan). – Ramhound Dec 5 '17 at 18:06
1
  1. Use these steps if you need to temporarily turn off Windows Defender Antivirus; however, if you do, your device may be vulnerable to threats.

    Open Windows Defender Security Center, then select Virus & threat protection > Threat settings. Turn off Real-time protection.

enter image description here Note: Scheduled scans will continue to run. However, files that are downloaded or installed will not be scanned.

  1. You can use Exclusions to let windows defender won't scan excluded files.

enter image description hereenter image description here

  • Thanks but Azure VM's in batch don't let you change these permissions. They're all locked down. – Bern Dec 6 '17 at 8:52
1

It's not uncommon for security software to lock files while they're scanned and thus get in the way of deleting files. Instead of trying to defeat the scans (which is often brittle), I've successfully use a more adaptive approach where failed deletes are queued for retry later on.

Contextualized for working on Azure Batch ...

  • Choose a location (such as %AZ_BATCH_NODE_SHARED_DIR%) for a text file that lists the files queued for deletion - pending-deletes.txt. (You might want to initialize this as a zero byte file in your job prep task)
  • When your task completes, try to delete the input file as usual
  • If the deletion works, great.
  • If the deletion fails, append the full path of that file as a new line in pending-deletes.txt, queuing it for later cleanup.
  • As a last step in running the task, run a script (I'd write it in PowerShell) that iterates through pending-deletes.txt checking each file.
    • If the file has already gone, or can now be deleted, remove it from pending-deletes.txt
    • Otherwise leave it listed for another attempt later on
  • (Optional) Do a final delete run as a part of your job release task to finish clean up
  • Thanks Bevan. I think it'd be easier just to reimage the VMs to flush out any Windows Defender "locked" files rather than going to the trouble of implementing this approach. – Bern Dec 7 '17 at 13:08
0

You probably have a couple of options that don't involve stopping the service. Ideally, just add an exclusion for the files/folders in question with Add-MpPreference

Something more like outright disablement would be to try disabling realtime protection, rather than stopping the service. See https://superuser.com/a/1025308 . (But its probably better, security-wise, to just add an exclusion)

  • I tried RDC'ing into the VM and running the PowerShell script - it didn't complain about there being an issue but it also didn't apply any update. The roles you can use to access the VM just don't have the privileges to perform this type of request. I can't even open Windows Defender on the VM without being blocked. – Bern Dec 6 '17 at 9:37

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.