Optimize Windows Defender exclusion script with native PowerShell #2930 #2939

IamLRBA · 2025-04-24T22:24:48Z

cc
@HannesWell
Hello,
Since the script as per @fdcastel, to add an exclusion to Windows Defender seems overly complex. Based on your concerns about the proposed Add-MpPreference -ExclusionProcess 'C:\Program Files\DBeaver\dbeaver.exe' script, this script replaces the original complex LINQ-based exclusion check with a more idiomatic and simpler version PowerShell implementation.

How It Addresses the your Concerns:

Duplicate Prevention: HashSet.Contains() check is just as effective as LINQ
Single Admin Context: All operations happen in one PowerShell invocation
No Growing Exclusion Lists: Only genuinely new paths get added

Fixes #2930

HannesWell · 2025-04-25T22:42:48Z

Thank you for this contribution. The changes look good too me and the script indeed looks cleaner. I'm not very familiar with Powershell and that was what I came up with after searching the internet a bit.

However, I could confirm that @fdcastel's objection is correct and this script could be even simpler.
If he doesn't want to contribute the simplification by himself, you could update this PR accordingly, but I would await his reaction first.

IamLRBA · 2025-04-27T21:10:15Z

Thank you for this contribution. The changes look good too me and the script indeed looks cleaner. I'm not very familiar with Powershell and that was what I came up with after searching the internet a bit.

However, I could confirm that @fdcastel's objection is correct and this script could be even simpler. If he doesn't want to contribute the simplification by himself, you could update this PR accordingly, but I would await his reaction first.

Thanks for your feedback @HannesWell, If @fdcastel approves I can proceed to update the PR...as per your guidance ofcourse!
Cheers!

fdcastel · 2025-04-28T17:30:52Z

Apologies for the delay (I was abroad).

I agree with @HannesWell that the script can be simplified even further.

@IamLRBA Based on my tests (and I believe @HannesWell can confirm as well), just using the call

Add-MpPreference -ExclusionProcess $pathsToExclude

should be sufficient. There is no need for any if statements or for instantiating a new Collections.Generic.HashSet[String].

IamLRBA · 2025-04-30T11:16:59Z

Thank you for the feedback @fdcastel . You're right upon re-testing with just: Add-MpPreference -ExclusionProcess $pathsToExclude, the command handles duplicates cleanly without throwing errors. I’ll simplify the script accordingly and update the PR shortly.

IamLRBA · 2025-04-30T11:57:11Z

@fdcastel, I've updated the script to simplify it as suggested. It now directly uses Add-MpPreference -ExclusionProcess $pathsToExclude without the extra conditionals or set creation. Let me know if anything else needs tweaking.
Thanks!
cc @HannesWell

fdcastel · 2025-04-30T19:55:19Z

Looks good to me! I don’t have a Java setup here to test it out, but the changes seem fine. 🚀 👍🏻

HannesWell

Thanks for the update.
Unfortunately this currently does not compile and a few points should be adjusted, but I made corresponding remarks below.

Furthermore, please squash your changes into one commit and force push that to your existing branch of this PR. Eventually we want to have this as one commit.

HannesWell · 2025-05-05T20:36:00Z

.../org.eclipse.ui.workbench/eclipseui/org/eclipse/ui/internal/WindowsDefenderConfigurator.java

-				"if($existingExclusions -eq $null) { $existingExclusions = New-Object Collections.Generic.HashSet[String] }", //$NON-NLS-1$
-				"$exclusionsToAdd=[Linq.Enumerable]::ToArray([Linq.Enumerable]::Where($exclusions,[Func[object,bool]]{param($ex)!$existingExclusions.Contains($ex)}))", //$NON-NLS-1$
-				"if($exclusionsToAdd.Length -gt 0){ Add-MpPreference -" + exclusionType + " $exclusionsToAdd }"); //$NON-NLS-1$ //$NON-NLS-2$
+		String excludedPaths = paths.stream().map(Path::toString).map(p -> "'" + p.replace("'", "''") + "'")


Can you please explain the advantage of using single-quotes (and escaping them) over double-quotes in a powershell script? As far as I can tell double-quotes are not allowed in Windows paths and therefore don't have to be escaped.

I had initially done this to handle the rare case of paths containing single quotes (which are technically valid in Windows paths)
However, as you noted, that might have just added unnecessary complexity.

HannesWell · 2025-05-05T20:37:23Z

.../org.eclipse.ui.workbench/eclipseui/org/eclipse/ui/internal/WindowsDefenderConfigurator.java

@@ -342,14 +342,12 @@ public static String createAddExclusionsPowershellCommand(String extraSeparator)
 		//
 		// For .NET's stream API called LINQ see:
 		// https://learn.microsoft.com/en-us/dotnet/api/system.linq.enumerable


This entire comment block (starting at its first line) can be replaced by the following:

// For detailed explanations about how to add new exclusions see: // https://learn.microsoft.com/en-us/powershell/module/defender/add-mppreference?view=windowsserver2019-ps

.../org.eclipse.ui.workbench/eclipseui/org/eclipse/ui/internal/WindowsDefenderConfigurator.java

IamLRBA · 2025-05-22T20:18:53Z

@HannesWell, Thanks so much for the corrections and changes suggested.
Please look at the current state of the script and we see what more we can change or if it is looking good.
Then we can proceed.
Cheers!

HannesWell

Thank you for the update and sorry for the delayed response.
The code change is mostly fine, just two remarks below.

After you have applied them, please locally squash all changes you made into your first commit and update the commit message if necessary to cover this change as a whole. Then fetch the upstream master and rebase on top of it. After that please force push the updated commit to this PR's branch so that eventually it just contains one commit.
Thank you :)

.../org.eclipse.ui.workbench/eclipseui/org/eclipse/ui/internal/WindowsDefenderConfigurator.java

IamLRBA · 2025-07-14T23:41:16Z

Thank you for the update and sorry for the delayed response. The code change is mostly fine, just two remarks below.

After you have applied them, please locally squash all changes you made into your first commit and update the commit message if necessary to cover this change as a whole. Then fetch the upstream master and rebase on top of it. After that please force push the updated commit to this PR's branch so that eventually it just contains one commit. Thank you :)

@HannesWell, I think I have successfully squashed the commits into one

Since the script to add an exclusion to Windows Defender seems overly complex, this script replaces the complex LINQ-based exclusion check with a more idiomatic and simpler version PowerShell implementation. Fixes eclipse-platform#2930

HannesWell

I think I have successfully squashed the commits into one

Yes you did, thanks for that. But the commit message needed a little tweaking.
Besides that I also applied my two pending requests and now this is ready for submission.

Thank you for this contribution to simplify the code. That's more than welcome.

github-actions · 2025-07-22T22:03:40Z

Test Results

2 778 files ±0 2 778 suites ±0 1h 31m 21s ⏱️ - 12m 50s
7 932 tests ±0 7 702 ✅ - 1 228 💤 ±0 2 ❌ +1
23 351 runs ±0 22 603 ✅ - 1 746 💤 ±0 2 ❌ +1

For more details on these failures, see this check.

Results for commit 43c3a07. ± Comparison against base commit 477d106.

IamLRBA · 2025-07-23T04:38:44Z

I think I have successfully squashed the commits into one

Yes you did, thanks for that. But the commit message needed a little tweaking. Besides that I also applied my two pending requests and now this is ready for submission.

Thank you for this contribution to simplify the code. That's more than welcome.

Thank you for the opportunity @HannesWell , You were a very helpful mentor!

HannesWell requested changes May 5, 2025

View reviewed changes

IamLRBA force-pushed the master branch from 68f2b23 to 56975e2 Compare May 22, 2025 20:12

HannesWell requested changes Jun 29, 2025

View reviewed changes

.../org.eclipse.ui.workbench/eclipseui/org/eclipse/ui/internal/WindowsDefenderConfigurator.java Outdated Show resolved Hide resolved

.../org.eclipse.ui.workbench/eclipseui/org/eclipse/ui/internal/WindowsDefenderConfigurator.java Outdated Show resolved Hide resolved

IamLRBA force-pushed the master branch 2 times, most recently from b1b238b to 45a70fd Compare July 14, 2025 23:38

HannesWell force-pushed the master branch 2 times, most recently from 00ce0a9 to 43c3a07 Compare July 22, 2025 21:24

HannesWell approved these changes Jul 22, 2025

View reviewed changes

HannesWell merged commit d0097a0 into eclipse-platform:master Jul 22, 2025
15 of 18 checks passed

Optimize Windows Defender exclusion script with native PowerShell #2930 #2939

Optimize Windows Defender exclusion script with native PowerShell #2930 #2939

Uh oh!

Conversation

IamLRBA commented Apr 24, 2025

Uh oh!

HannesWell commented Apr 25, 2025

Uh oh!

IamLRBA commented Apr 27, 2025

Uh oh!

fdcastel commented Apr 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

IamLRBA commented Apr 30, 2025

Uh oh!

IamLRBA commented Apr 30, 2025

Uh oh!

fdcastel commented Apr 30, 2025

Uh oh!

HannesWell left a comment

Choose a reason for hiding this comment

Uh oh!

HannesWell May 5, 2025

Choose a reason for hiding this comment

Uh oh!

IamLRBA May 22, 2025

Choose a reason for hiding this comment

Uh oh!

HannesWell May 5, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

IamLRBA commented May 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

HannesWell left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

IamLRBA commented Jul 14, 2025

Uh oh!

HannesWell left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Jul 22, 2025

Test Results

Uh oh!

Uh oh!

IamLRBA commented Jul 23, 2025

Uh oh!

Uh oh!

fdcastel commented Apr 28, 2025 •

edited

Loading

IamLRBA commented May 22, 2025 •

edited

Loading