Microsoft Defender AV must be configured to enable the Automatic Exclusions feature.

This setting allows an administrator to specify if Automatic Exclusions feature for Server SKUs should be turned off.

Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Exclusions >> "Turn off Auto Exclusions" is set to "Disabled".

Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Exclusions

Criteria: If the value "DisableAutoExclusions" is REG_DWORD = 0, this is not a finding.

NOTE: The configuration of WNDF-AV-000100 will likely hide this setting from being reviewed. If compliance can be shown via group policy editor or other means, this is not a finding.

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Exclusions >> "Turn off Auto Exclusions" to "Disabled".