--- title: "Add-VBRMalwareDetectionExclusion" description: "This cmdlet adds a malware exclusion rule for a machine. Depending on the rule, Veeam Backup & Replication either excludes the machine entirely from all automated malware detection mechanisms or applies the granular exclusions that you specify." canonical: "https://helpcenter.veeam.com/docs/vbr/powershell/add-vbrmalwaredetectionexclusion.html" breadcrumb: "Veeam PowerShell Reference > Veeam PowerShell Reference > Managing Security Settings > Malware Detection > Add-VBRMalwareDetectionExclusion" dateModified: "2026-08-19" --- # Add-VBRMalwareDetectionExclusion ## Short Description Adds a malware exclusion rule. **Product Edition**: Standard, Enterprise, Enterprise Plus, Veeam Universal License ## Syntax ``` Add-VBRMalwareDetectionExclusion [-Entity] [-Note ] [-ExcludedPaths ] [-ExcludedActivities ] [-AutoScanDisabled ] [-ExcludeEntireObject ] [] ``` ## Detailed Description This cmdlet adds a malware exclusion rule for a machine. Depending on the rule, Veeam Backup & Replication either excludes the machine entirely from all automated malware detection mechanisms or applies the granular exclusions that you specify. You can add machines of the following types: - VMware vSphere VMs. - Hyper-V VMs. - VMware Cloud Director VMs. - Physical and cloud machines discovered by protection groups. To skip the machine from all automated malware detection mechanisms, set the `ExcludeEntireObject` parameter to `$True`. To create a partial exclusion that targets specific algorithms, paths, or autoscan, specify the `ExcludedActivities`, `ExcludedPaths` or `AutoScanDisabled` parameters. You must specify either the `ExcludeEntireObject` parameter or at least one of the granular exclusion parameters. ::: note Malware exclusions apply only to file system activity analysis (guest indexing data scan) and inline entropy analysis (inline scan). They do not affect scans performed by Veeam Threat Hunter, third-party antivirus software, or YARA. ::: ::: note If a malware exclusion for the specified machine already exists, the cmdlet throws an error. To modify an existing exclusion, run the [`Set-VBRMalwareDetectionExclusion`](set-vbrmalwaredetectionexclusion.md) cmdlet. ::: ## Parameters

Parameter

Description

Type

Required

Position

Accept Pipeline Input

AutoScanDisabled

Defines whether Veeam Backup & Replication will run autoscan for the machine:

  • $True: autoscan will be disabled for the machine. Set this value when autoscan is not applicable to the machine, for example, for machines with disks encrypted by software such as BitLocker, VeraCrypt, or LUKS, or for Linux machines in an environment that has no Linux Mount Server.
  • $False: autoscan will run for the machine.

Default: $False.

Boolean

False

Named

False

Entity

Specifies a machine that you want to add to a malware exclusions list. Veeam Backup & Replication will skip this machine from malware scan.

Accepts the following types of objects:

Object

True

0

True (ByPropertyName, ByValue)

ExcludedActivities

Specifies an array of malware detection activities that Veeam Backup & Replication will skip for the machine. The following activity values are supported:

  • DeletedUsefulFiles: skip detection of deleted files.
  • RansomwareNotes: skip detection of ransomware notes.
  • RansomwareExtensions: skip detection of suspicious file extensions.
  • EncryptedData: skip detection of encrypted files.
  • RenamedFiles: skip detection of bulk file rename activity.
  • SuspiciousFilesInDelta: skip detection of indicators of compromise.

Note: The YaraScan and AntivirusScan values are part of the VBRActivityType enumeration but cannot be used with this parameter.

Duplicate values in the array are removed before saving.

VBRActivityType[]

False

Named

False

ExcludedPaths

Specifies an array of file or folder paths that Veeam Backup & Replication will skip from file system activity analysis for the machine. Each path must be one of the following:

  • An absolute Windows path that starts with a drive letter (for example, C:\Users\Veeam\Documents\Data.docx).
  • An absolute Linux path that starts with / (for example, /var/log/).

To exclude a folder, add a trailing slash to the path. Veeam Backup & Replication removes surrounding double quotes and duplicate entries from the array before saving.

String[]

False

Named

False

ExcludeEntireObject

Defines that the machine will be skipped by all file system activity analysis and inline entropy analysis malware detection mechanisms.

To create a partial exclusion that skips only specific algorithms, paths, or autoscan, use the ExcludedActivities, ExcludedPaths, or AutoScanDisabled parameters instead.

Default: $False.

Boolean

False

Named

False

Note

Specifies a note for a machine. Maximum length: 255 characters.

String

False

Named

False
`` This cmdlet supports Microsoft PowerShell common parameters. For more information on common parameters, see [ Microsoft Docs](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_commonparameters?view=powershell-7). ## Output Object [`VBRMalwareDetectionExclusion`](vbrmalwaredetectionexclusion.md) ## Examples ::: example ### Example 1. Excluding VMware vSphere VM from Malware Scan This example shows how to exclude the `WinSrv2049` VM from the malware scan. ``` $vm = Find-VBRViEntity -Name "WinSrv2049" Add-VBRMalwareDetectionExclusion -Entity $vm -ExcludeEntireObject $True ``` Perform the following steps: 1. Run the [`Find-VBRViEntity`](find-vbrvientity.md) cmdlet. Specify the `Name` parameter value. Save the result to the `$vm` variable. 2. Run the `Add-VBRMalwareDetectionExclusion` cmdlet. Set the `$vm` variable as the `Entity` parameter value. Set the `$True` value as the `ExcludeEntireObject` parameter value. ::: ::: example ### Example 2. Excluding Activities and Paths from Malware Scan This example shows how to add a partial exclusion for the `WinSrv2049` VM that skips specific malware detection activities and file paths. ``` $vm = Find-VBRViEntity -Name "WinSrv2049" Add-VBRMalwareDetectionExclusion -Entity $vm -ExcludedActivities RansomwareNotes, RansomwareExtensions -ExcludedPaths "C:\Users\Veeam\Logs\", "/var/log/" ``` Perform the following steps: 1. Run the [`Find-VBRViEntity`](find-vbrvientity.md) cmdlet. Specify the `Name` parameter value. Save the result to the `$vm` variable. 2. Run the `Add-VBRMalwareDetectionExclusion` cmdlet. Specify the following settings: - Set the `$vm` variable as the `Entity` parameter value. - Set the `RansomwareNotes` and `RansomwareExtensions` values as the `ExcludedActivities` parameter value. - Specify the `ExcludedPaths` parameter value. ::: ## Related Commands [`Find-VBRViEntity`](find-vbrvientity.md)