Running Backup and Restore on Windows 10 1909, I noticed that the backup was very slow because Windows Defender (MsMpEng.exe) used most of the CPU time. In the Windows Defender configuration I excluded the process C:\Windows\System32\svchost.exe, which is the process running the backup service. But that feels like a potentially dangerous overkill.

Is there a way to exclude a service (instead of a process) in Windows Defender?

  • Don't exclude svchost.exe as it's not just one thing, but many things; excluding it makes the PC vulnerable to malware. Generally, files backed up should be scanned for malware unless independently running regular malware scans on your backup location and intend to do so prior to restoring any file from a backup. Services are executable files, so you can add the individual executables to the Windows Defender Exclude List. For the CPU usage, there's likely a way to limit that, but I'm not sure how.
    – JW0914
    May 19 '20 at 11:57
  • How can I find out which executable is actually run by svchost.exe to perform the backup? According to the service's properties, its C:\WINDOWS\system32\svchost.exe -k SDRSVC.
    – maf
    May 19 '20 at 12:53
  • Not a clue... you may want to reference Microsoft Docs for the svchost man page
    – JW0914
    May 19 '20 at 13:04
  • I have now excluded C:\WINDOWS\System32\SDRSVC.dll instead of svchost.exe. I found the DLL's path by looking at the backup process' properties in Sysinternals Process Monitor. On a first backup test run, this seemed to work.
    – maf
    May 19 '20 at 14:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.