How do I add an XMRig exclusion in Windows Defender?

You can add an XMRig exclusion in Windows Security under Virus & threat protection → Manage settings → Exclusions. Do this only for an XMRig copy you deliberately downloaded and trust, because an exclusion tells Microsoft Defender Antivirus to skip scanning that file.

Before you make the exception

XMRig is mining software that uses your computer’s processor to help mine cryptocurrencies such as Monero. It runs as a separate program, not inside your web browser.

Defender may flag mining software because attackers also install it on other people’s computers without permission. A warning does not automatically mean your copy is harmful, but you should not assume every XMRig download is safe.

Before continuing:

• Make sure you downloaded it from the official XMRig project or its official GitHub releases.
• Avoid copies sent through messages, bundled with unrelated software, or advertised as “undetectable.”
• If a release provides a SHA-256 checksum, compare it with your downloaded file. This is a digital fingerprint used to check whether a file matches the published release.
• Only mine on a computer you own or have explicit permission to use.

If you never installed XMRig yourself, do not exclude it. Let Defender investigate or remove it.

Add an exclusion for the executable

For the narrowest practical exception, exclude xmrig.exe, the file that starts XMRig, rather than your entire Downloads folder.

On Windows 10 or Windows 11:

1. Open Start, type Windows Security, and open it.
2. Select Virus & threat protection.
3. Under Virus & threat protection settings, select Manage settings.
4. Scroll down to Exclusions.
5. Select Add or remove exclusions.
6. Approve the administrator permission prompt if one appears.
7. Select Add an exclusion → File.
8. Browse to your extracted XMRig folder, select xmrig.exe, and confirm.

Check that the correct file path now appears in the exclusions list. If you later move XMRig to another folder, the exclusion for its old location will not cover the new location.

If Defender already quarantined XMRig

Quarantine means Defender has isolated a detected file so it cannot run. If xmrig.exe has disappeared, open Windows Security → Virus & threat protection → Protection history.

Expand the relevant detection and check its file path. Confirm that it refers to the trusted XMRig download you intentionally installed—not an unfamiliar copy elsewhere on your computer.

Only after verifying the download should you use the available restore option. The actions shown can vary with the detection and your Windows settings. On a work or school computer, contact your administrator rather than trying to bypass a security policy.

Do not switch off real-time protection just to get the miner running.

Keep the exception small

Avoid excluding a whole drive, your user folder, or every .exe file. A folder exclusion also leaves other files placed inside that folder outside Defender’s normal scanning.

Choose File, not Process, for the steps above. A process exclusion has different behavior: it can exclude files opened by that process from real-time scanning, rather than simply exempting the program itself.

An exclusion is not proof that a file is safe, and it may not bypass every Windows security control.

The bottom line

Verify your XMRig download, then exclude only its specific xmrig.exe file. Keep Defender enabled, and remove the exclusion from the same settings page when you stop using the miner.