Windows Defender Blocks Miners: How to Add Folders to Exclusions

Microsoft Defender often deletes miners the moment you extract the archive: Gminer, lolMiner, SRBMiner-Multi, XMRig and others. An entry such as PUA:Win32/CoinMiner shows up in Protection history, and the .exe disappears from the folder. This guide explains why that happens, shows three ways to add your mining folder to exclusions, walks through restoring a file from quarantine and helps you tell a false positive from a real threat.

📌 Status as of October 3, 2026: menu paths and commands were checked against Microsoft Learn and support.microsoft.com. Item names can differ slightly between Windows 10 and Windows 11 builds.

⚠️ Important. Only exclude a dedicated folder (for example, C:\miners), never the whole C:\ drive. Download miners only from the developers' release pages.

Why Defender removes miners

Microsoft states plainly that coin miners aren't inherently malicious: people and companies legitimately invest in hardware and electricity to mine. The same code, however, is secretly installed on other people's computers to mine at their expense. That's why Microsoft classifies software that uses device resources to mine cryptocurrency as a potentially unwanted application (PUA). It isn't a virus but a separate category: Defender is warning you that a miner could have landed on the PC without the owner knowing.

The detection name follows the CARO scheme Type:Platform/Family. The first part tells you how serious it is:

Caution with a Trojan: verdict is justified. Microsoft documents a real attack in which a malicious Word document downloaded a modified XMRig that mined Monero on the infected machine and was detected as Trojan:Win32/Coinminer. The word "miner" in a file name guarantees nothing: what matters is where your particular file came from.

🛡️ An exclusion turns off scheduled, on-demand and real-time scanning for the folder, including PUA detection. Only verified software should go into that folder.

Preparation: a dedicated folder and an archive check

The order of steps matters more than the method you pick. If you extract the archive before setting up the exclusion, Defender will have time to delete some of the files.

Step 1. Create a folder for miners

For example, C:\miners. Use Latin characters only, without spaces: non-Latin characters in the path are one of the common reasons a miner won't start or crashes immediately. Put each miner in its own subfolder: C:\miners\srbminer, C:\miners\lolminer.

Step 2. Add the folder to exclusions

Any of the three methods below works. You don't need to add subfolders separately: a folder exclusion covers every file and subfolder inside it.

Step 3. Download the archive from the release page

Links to the official repositories are collected in Mining software in October 2026: which miners are maintained, which are abandoned, and what to install. Save the archive straight into C:\miners, not into Downloads.

Step 4. Check the hash

If the developer publishes checksums, compare them with the hash of the downloaded file. For example, XMRig posts a SHA256SUMS file on every release page. The built-in PowerShell command computes SHA256 by default:

Get-FileHash "C:\miners\xmrig-6.26.0-windows-x64.zip"

Compare the Hash value with the published one; letter case doesn't matter. If it doesn't match, delete the archive and download it again from the release page.

Step 5. Extract the archive in the same folder

Now the miner files won't disappear during extraction or after a reboot.

Method 1: a PowerShell command

The fastest way, with no menus to click through.

1. Press Win + X and choose "Terminal (Admin)" or "Windows PowerShell (Admin)". Microsoft specifies that exclusion commands run in an elevated window.
2. Paste the command and press Enter:

Add-MpPreference -ExclusionPath "C:\miners"

Replace C:\miners with the path to your folder. You can add several folders in one command, separated by commas:

Add-MpPreference -ExclusionPath "C:\miners", "D:\miners"

⚠️ Important. Use Add-MpPreference: it appends the path to the existing list. Set-MpPreference with the same parameter overwrites the entire exclusion list of that type, and your previous exclusions will be gone.

Use the full path rather than variables like %USERPROFILE% or %TEMP%. The Defender service runs as the system account, so such variables inside an exclusion point to the system profile, not to your user folder.

Verify active exclusions

Get-MpPreference | Select-Object -ExpandProperty ExclusionPath

PowerShell prints every excluded path, one per line.

Method 2: a .bat script for rigs

If you set up several rigs or reinstall Windows often, a ready-made batch file saves time.

1. Create a file named add_exclusion.bat in Notepad.
2. Paste the script:

@echo off
:: Request administrator privileges
net session >nul 2>&1
if %errorlevel% neq 0 (
    echo Administrator privileges required. Elevating...
    powershell -Command "Start-Process '%~f0' -Verb RunAs"
    exit /b
)

:: Folder that contains this script, without the trailing backslash
set "TARGET_DIR=%~dp0"
set "TARGET_DIR=%TARGET_DIR:~0,-1%"

:: Refuse to run from a drive root
if "%TARGET_DIR:~-1%"==":" (
    echo The script is in a drive root. Move it into your mining folder.
    pause
    exit /b 1
)

powershell -Command "Add-MpPreference -ExclusionPath '%TARGET_DIR%'"
echo Folder "%TARGET_DIR%" added to Windows Defender exclusions.
pause

3. Put the file in your mining folder and double-click it. The script requests administrator rights on its own and excludes the folder it sits in.

⚠️ Important. The script excludes the folder it's located in. Run it from the Desktop or Downloads, and those folders are the ones left unscanned. The script stops if it's launched from a drive root.

Method 3: the Windows Security app

1. Open Start → Windows Security. Alternatively: Settings (Win + I) → Privacy & security → Windows Security; on Windows 10 it's Update & Security → Windows Security.
2. Select Virus & threat protection.
3. Under Virus & threat protection settings, click Manage settings.
4. Scroll down to Exclusions and select Add or remove exclusions. Confirm the User Account Control prompt.
5. Click Add an exclusion → Folder and select your mining folder.

The menu offers four exclusion types, and not all of them fit mining:

How to check that the exclusion works

The built-in MpCmdRun.exe utility reports whether a specific path is excluded. The check is available in Defender 4.18.2111-5.0 (December 2021) and later. The current copy of the utility sits in the Defender platform folder, so the command finds it first. Run it in an elevated window:

$platform = Get-ChildItem "$env:ProgramData\Microsoft\Windows Defender\Platform" -Directory | Sort-Object Name -Descending | Select-Object -First 1
& "$($platform.FullName)\MpCmdRun.exe" -CheckExclusion -Path "C:\miners\srbminer"

If there's no Platform folder, the utility lives in C:\Program Files\Windows Defender.

The answer is excluded (exit code 0) means the path isn't scanned; is not excluded (exit code 1) means it is. Keep in mind that is excluded doesn't mean this exact path is on the list. A parent folder such as C:\miners on the list is enough.

How to restore a miner from quarantine

Add the folder to exclusions first, then restore the file. Microsoft warns that Defender will detect a restored file again and create a new entry that needs action.

Through Protection history

1. Windows Security → Virus & threat protection → under Current threats, select Protection history.
2. If the list is long, filter it by quarantined items.
3. Open the card for the miner. Threat details are visible only to a user with administrator rights.
4. Click Actions → Restore.
5. If the file wasn't restored into the excluded folder, move it to C:\miners.

What the Protection history entries mean:

Protection history keeps events for only two weeks, after which they disappear. If the entry you need is gone, it's easier to download the archive again and check the hash.

From the command line

The same MpCmdRun.exe lists quarantined items and restores them:

$platform = Get-ChildItem "$env:ProgramData\Microsoft\Windows Defender\Platform" -Directory | Sort-Object Name -Descending | Select-Object -First 1
$mp = "$($platform.FullName)\MpCmdRun.exe"
& $mp -Restore -ListAll
& $mp -Restore -Name "PUA:Win32/CoinMiner" -Path "C:\miners"

The -ListAll switch lists everything in quarantine. The -Name switch restores the most recently quarantined item with the given threat name; take the name from the -ListAll output. With -Path, the file is restored to the specified folder but also stays in quarantine. Without -Path, the file goes back to its original location and is removed from quarantine.

PowerShell lists the threats Defender has handled, together with file paths:

Get-MpThreat | Select-Object ThreatName, DidThreatExecute, Resources

The Resources field shows the path to the file that Defender flagged.

Tamper Protection and exclusions

Tamper Protection stops apps from changing important Defender settings such as real-time protection and cloud-delivered protection. An administrator can still change them in the Windows Security app. Microsoft classifies software that disables or uninstalls security software as a separate threat class (tampering software). If a mining "optimizer" insists on turning Defender off completely, treat that as a red flag.

On a home PC, Tamper Protection doesn't stop you from adding exclusions. It protects exclusion lists only on organization-managed devices: that requires management through Intune or Configuration Manager, the DisableLocalAdminMerge setting and Defender platform 4.18.2211.5 or later. Keep Tamper Protection on: on a home PC it doesn't block a folder exclusion.

A work computer is a different story. By default, local exclusions are merged with exclusions from organization policies, but policy wins in a conflict, and with DisableLocalAdminMerge local exclusions don't apply at all.

Status of Tamper Protection and real-time protection:

Get-MpComputerStatus | Select-Object IsTamperProtected, RealTimeProtectionEnabled

True means the feature is on. The Tamper Protection toggle sits next to the exclusions: Virus & threat protection → Manage settings. You can't configure it through PowerShell during normal operation.

PowerShell cheat sheet

Run every command in an elevated PowerShell window.

There's no need to exclude extensions with -ExclusionExtension for mining. Such an exclusion applies across the whole PC, and Microsoft explicitly lists .exe, .bat, .zip and .7z as extensions you shouldn't exclude.

What not to do

• Don't exclude the whole drive (C:\), the C:\Users folder including Downloads, C:\Temp or Windows temp folders. Microsoft lists them among paths you shouldn't exclude.
• Don't exclude the .exe, .bat, .cmd, .ps1, .zip or .7z extensions; they're on the same Microsoft list.
• Don't exclude the powershell.exe and cmd.exe processes: Microsoft also names them among processes that attackers abuse.
• Don't define a process exclusion by name alone (miner.exe): it matches any file with that name in any folder. Microsoft recommends using the full path.
• Don't disable Defender entirely through the registry or tweaking tools. Microsoft calls a targeted exclusion safer than turning protection off. Real-time protection switched off with the toggle also turns itself back on after a while.
• Don't keep unrelated files in the excluded folder: only archives from release pages with a verified hash belong there.

If the exclusion doesn't help

The file is deleted even though the exclusion exists. Check the path with MpCmdRun.exe -CheckExclusion. Common causes: a new miner version was extracted into a different folder, the exclusion uses an environment variable instead of a full path, or it points to a mapped network drive. Microsoft advises against excluding mapped network drives; use the actual network path instead.

Windows 11 blocks the launch and the notification mentions Smart App Control. This feature blocks unsigned apps when Microsoft's cloud service can't confidently predict that they're safe. Defender exclusions don't bypass it: according to Microsoft, there's no way to allow an individual app, you can only turn the feature off entirely in Windows Security → App & browser control. Recent Windows builds let you turn it back on without reinstalling the system.

Microsoft Edge won't let you download the archive. That's potentially unwanted app blocking: the Block downloads option under App & browser control → Reputation-based protection works only in Edge. If you trust the source, open Protection history, select the blocked app entry, click Actions → Allow and download the file again. Microsoft recommends keeping the blocking itself turned on.

The miner won't start, but the files are in place. Then the antivirus isn't the problem. A small page file is a frequent cause of crashes, see Page file for mining: how much to set and how to configure it in Windows. The other causes are covered in Miner won't start or crashes immediately: 8 causes and fixes.

You're sure it's a false positive. Submit the file for analysis through the Microsoft Security Intelligence portal. Microsoft analysts determine whether it's a threat, an unwanted application or a normal file.

Frequently asked questions (FAQ)

Is it safe to add a miner to exclusions? Yes, if the folder is dedicated, the archive came from the developer's release page and the hash matches. The exclusion lifts scanning only for that folder; the rest of the system stays protected as before.

Why does Defender flag a miner downloaded from the official GitHub? Microsoft classifies mining software as potentially unwanted because it's often installed on other people's computers without the owner knowing. Defender reacts to the type of program, not to a specific developer.

Do I need to disable Defender to mine? No. One excluded folder is enough. Real-time protection switched off with the toggle turns itself back on after a while anyway.

Do I need to add each subfolder separately? No. A folder exclusion covers every file and subfolder inside it, so a single C:\miners entry is enough.

How is an exclusion different from Allow on device? Allow on device applies to one specific detected threat: Defender stops acting on it, and the threat appears on the Allowed threats page. You can undo it there with the Don't allow button. A folder exclusion works for any file inside the folder, including future miner versions.

What if Defender reports a Trojan rather than a PUA? Don't restore the file right away. Check where the archive came from and compare the hash with the published one. If everything matches and you're confident it's a false positive, submit the file to Microsoft for analysis.

Does the exclusion work if another antivirus is installed? No. When you install a compatible third-party antivirus, Microsoft Defender turns itself off, and exclusions have to be set up in the new antivirus.

Sources

Data checked on October 3, 2026. Cryptolexicon is an independent reference and is not affiliated with Microsoft.

• Microsoft Learn — Add-MpPreference and Remove-MpPreference: syntax, folder exclusion, error when removing a path that isn't on the list.
• Microsoft Learn — Configure custom exclusions: elevated window, Set-MpPreference overwriting the list, MpCmdRun.exe -CheckExclusion.
• Microsoft Learn — Exclusions in Microsoft Defender Antivirus: exclusion types, subfolders, processes, system environment variables, PUA, network drives, merging with policies.
• Microsoft Learn — Exclusions to avoid: paths, extensions and processes you shouldn't exclude.
• Microsoft Learn — Restore quarantined files and MpCmdRun command-line arguments: -Restore -ListAll, -Name, -Path.
• Microsoft Learn — Tamper protection overview, protecting exclusions and configuring it on Windows: protected settings, conditions for protected exclusions, Get-MpComputerStatus.
• Microsoft Learn — Coin miners, malware and PUA criteria and malware naming: miners as PUA, the XMRig example, tampering software, the naming scheme.
• Microsoft Learn — Block potentially unwanted applications: the PUA: prefix, Get-MpThreat.
• Microsoft Learn — Get-FileHash and Get-MpThreatDetection.
• Microsoft Support — Virus and threat protection: path to exclusions, exclusion types, Allowed threats, Tamper Protection, third-party antivirus.
• Microsoft Support — Protection history: entry types, restoring, two-week retention.
• Microsoft Support — App & browser control, PUA protection and Smart App Control FAQ.
• Microsoft Security Intelligence — Submit a file for analysis and PUA:Win32/CoinMiner description.
• XMRig — release v6.26.0: the SHA256SUMS file with archive hashes.

This material is for informational purposes only and is not financial advice. Menu paths and commands were checked on October 3, 2026 and may differ depending on your Windows build.