Good daay guys! I'm trying to optimize an environment which is quite large and running FSLogix containers and non persisten VDAs through PVS. I have started by going through their AV Exclusions. Do you guys usually exclude stuff like C:\Windows\explorer.exe , C:\Windows\System32\backgroundTaskHost.exe etc? I see that these are scanned the most when I run the following for a few hours to deepdive into what is actually being scanned. Not sure how accurate this is. New-MpPerformanceRecording -RecordTo C:\Temp\Defender.etl Get-MpPerformanceReport -Path C:\Temp\Defender.etl -TopFiles 50 -TopProcesses 20

i typically only exclude vendor specified exclusions. That would be considered best practice. There will always be exceptions to this rule, but just don't start with it unless you're seeing a problem.

I would not exclude explorer.exe, look more to exclude extensions being scanned.

thanks guys!