Windows Defender Detecting Samples Even After Automatic Sample Submission Disabled

Windows Defender continues to detect and submit virus samples even after Automatic Sample Submission is disabled because the feature controls telemetry sharing, not the detection engine itself. To stop detections entirely for specific files or folders, you must add them to the Windows Security exclusion list via Group Policy or registry settings. This ensures that the antivirus engine ignores the specified paths while maintaining system protection against other threats.

Understanding Automatic Sample Submission vs. Detection

It is a common misconception that disabling Automatic Sample Submission stops Windows Defender from flagging malicious files. In reality, these two functions serve different purposes within the Microsoft Defender Antivirus architecture. Automatic Sample Submission is a telemetry feature that sends suspicious files to Microsoft for analysis to improve cloud-based protection signatures. Disabling it prevents your machine from uploading data but does not alter how the local engine scans files. If you are testing malware samples in a controlled environment, you need to prevent the detection engine from quarantining or deleting the files. The detection mechanism operates independently of the submission setting. Therefore, simply turning off sample submission will not stop the alerts or the removal of the test files. You must explicitly configure exclusions to bypass the scanning process for those specific items. For more context on how Microsoft Defender categorizes threats, see Understanding WindowsDefender Detection Types: Concrete. This article explains the different levels of detection confidence and how they influence automatic actions.

Adding Exclusions via Windows Security Settings

The most straightforward method to prevent Windows Defender from detecting specific files is through the graphical user interface. This approach is suitable for individual users who do not have strict enterprise group policies enforced on their machines. Follow these steps to add an exclusion:

• Open the Start menu and search for "Windows Security" to launch the application.
• Navigate to Virus & threat protection in the main dashboard.
• Under the Virus & threat protection settings section, click on Manage settings.
• Scroll down to the Exclusions section and select Add or remove exclusions.
• Click Add an exclusion and choose between File, Folder, File Type, or Process.
• Select the specific file or folder containing your test samples and confirm the addition.

Once added, Windows Defender will ignore any changes made to these excluded items. They will not be scanned, quarantined, or deleted. However, this method requires administrative privileges and may be overridden by domain policies in corporate environments.

Configuring Exclusions via Group Policy

In managed environments, individual settings are often locked out by administrators. Using Group Policy allows you to enforce exclusions across multiple systems or ensure persistent configuration that survives UI resets. This method is particularly useful if you cannot access the standard exclusion menu due to policy restrictions. To apply this configuration:

1. Press Win + R, type gpedit.msc, and press Enter to open the Local Group Policy Editor.
2. Navigate to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus.
3. Locate the policy named Configure exclusions and double-click it to edit.
4. Set the policy to Enabled.
5. In the options panel, specify the paths or file types you wish to exclude. For example, you can enter C:\TestSamples\ to exclude an entire directory.
6. Click OK to save the changes.

After applying the policy, run gpupdate /force in Command Prompt to ensure the settings take effect immediately. This method provides a robust solution for preventing detection without relying on the UI.

Verifying Exclusion Effectiveness

After configuring exclusions, it is crucial to verify that they are working correctly. Simply adding an exclusion does not guarantee immediate results if the service has not refreshed its cache. To verify the setup:

• Create a copy of a known harmless test file (such as a text file renamed with a suspicious extension) inside your excluded folder.
• Wait for approximately 30 seconds to allow the real-time protection scanner to refresh.
• Check the Protection history in Windows Security to ensure no new alerts were generated for the file.
• If detections still occur, check the Exclusion list again to ensure the path was entered correctly without trailing slashes or typos.

Note that exclusions do not provide immunity from cloud-delivered updates. If Microsoft releases a critical signature update, it may temporarily override local exclusions depending on the severity level. For more information on managing security settings alongside third-party software, refer to Dell Pre-installed McAfee Uninstallation Causes Windows Security Issues.

Risks of Disabling Protection

While excluding folders is effective for testing, it introduces significant security risks. Any malware placed in an excluded directory will remain active on your system. It is essential to only use isolated virtual machines or air-gapped systems for such activities. Never disable protections on a primary workstation connected to a network. Additionally, some advanced malware techniques may attempt to exploit the exclusion list itself. Always keep your operating system updated to patch vulnerabilities that could be leveraged by malicious actors targeting unprotected directories. Regularly review your exclusion list to remove unnecessary entries once testing is complete.

Frequently Asked Questions

Why does Windows Defender still alert me after I add an exclusion?

Alerts may persist if the exclusion was applied to the wrong path format or if the real-time scanner cache has not refreshed. Ensure you are using absolute paths and restart the Windows Defender Antivirus service to force a configuration reload.

Can I disable Windows Defender completely instead of using exclusions?

Disabling Windows Defender entirely is not recommended as it leaves your system vulnerable to active threats. Microsoft restricts permanent disabling through standard settings, and doing so may violate organizational security policies or void support agreements.

Do exclusions affect performance during virus scans?

Yes, exclusions significantly improve scan performance by skipping large directories or high-volume log files. This reduces CPU usage and shortens scan times without compromising the detection of threats outside the excluded areas.

Will automatic updates override my exclusion settings?

No, standard signature updates respect existing exclusion configurations. However, extremely severe threats may trigger emergency overrides in rare cases, though this is uncommon for standard user-defined exclusions.

How do I check which files are currently excluded?

You can view all active exclusions by navigating to Virus & threat protection settings and clicking Manage settings under the Exclusions section. This list displays all files, folders, and processes currently ignored by the scanner.