Windows Defender Blocks Miners: How to Add Folders to Exclusions

Almost all mining software (Gminer, Rigel, lolMiner, XMRig) gets flagged by Microsoft Defender as a potential threat: PUA:Win32/CoinMiner, Trojan:Win32/Wacatac, or Riskware.

Antivirus engines alert on code that utilizes GPU/CPU compute cycles for proof-of-work calculations. As long as you downloaded the binary directly from the developer's official GitHub repository, this detection is a false positive.

Here are 3 ways to add your miners directory to Defender exclusions so files are not removed upon extraction or after system reboot.

⚠️ Important: Only whitelist a dedicated folder (e.g., C:\miners), never your entire C:\ drive or Downloads folder. Always verify download hashes from official repositories.

Method 1: PowerShell One-Liner (Fastest)

1. Press Win + X and choose Terminal (Admin) or PowerShell (Admin).
2. Run the following command:

Add-MpPreference -ExclusionPath "C:\miners"

(Replace C:\miners with your actual mining folder path).

Verify active exclusions:

Get-MpPreference | Select-Object -ExpandProperty ExclusionPath

Method 2: Automatic .bat Script

Useful if you manage multiple mining rigs or frequently reinstall Windows:

1. Create a new text file named add_exclusion.bat.
2. Paste the following script:

@echo off
:: Request administrator privileges
net session >nul 2>&1
if %errorlevel% neq 0 (
    echo Administrator privileges required. Elevating...
    powershell -Command "Start-Process '%~f0' -Verb RunAs"
    exit /b
)

:: Whitelist current folder where the script is located
set TARGET_DIR=%~dp0
set TARGET_DIR=%TARGET_DIR:~0,-1%

powershell -Command "Add-MpPreference -ExclusionPath '%TARGET_DIR%'"
echo Folder "%TARGET_DIR%" added to Windows Defender exclusions.
pause

3. Place this .bat inside your mining folder and run it with administrator rights.

Method 3: Windows 10 / 11 GUI Settings

1. Open Settings (Win + I) → Privacy & Security → Windows Security.
2. Click Virus & threat protection.
3. Under Virus & threat protection settings, click Manage settings.
4. Scroll down to Exclusions and select Add or remove exclusions.
5. Click Add an exclusion → Folder → select your mining directory.

How to Restore Removed Miners from Quarantine

If Windows Defender already quarantined your .exe file before you configured exclusions:

1. In Virus & threat protection, open Protection history.
2. Click on the blocked item (CoinMiner / Severe / Low).
3. Click Actions → Restore.
4. Move the restored executable to your whitelisted folder.

Useful PowerShell Defender Commands

Summary

Never disable Windows Defender completely using third-party registry tweaks or debloaters — this leaves your system exposed to actual stealers and malware. Keeping an isolated folder (such as C:\miners) in exclusions is clean, safe, and avoids false positives permanently.