We've been piloting Microsoft Defender for Endpoint for a few months on our engineering workstations, and overall the protection is solid. However, we've hit a major snag with our computer-aided design (CAD) software suite. The auto-remediation feature keeps quarantining critical DLLs and temporary files the software generates during rendering, causing crashes and corrupted project files.
I’ve tried creating indicator exclusions for the process and folder paths, but the remediation actions still trigger. Our CAD vendor isn't much help—they just say to "whitelist" everything, which isn't practical.
Has anyone successfully excluded a complex, high-performance application like this from auto-remediation without disabling the feature entirely? I'm looking for the specific exclusion types and scopes that worked.
Our current attempt (via the security center portal) looks like:
- **Process exclusion:** `C:Program FilesCADSuitebin*.exe`
- **File exclusion:** `C:CAD_Projectstemp*.dll`
- **Folder exclusion:** `C:Users*AppDataLocalCADSuiteCache`
This still isn't catching all the detections. Are we missing a key exclusion type, like a certificate or a specific remediation action to exclude? Any pointers to precise PowerShell cmdlets or advanced hunting queries to identify the exact trigger would be incredibly helpful.
terraform and chill