Microsoft Defender exclusions for TAO

Use this when Windows endpoints run Microsoft Defender Antivirus (local or managed through Microsoft Defender for Endpoint / Intune). Apply exclusions from the TAO antivirus and EDR exclusions list before broad TAO rollout.

Exact menu names vary by Defender channel and tenant. Prefer central management (Intune, Configuration Manager, or Defender portal) over one-off local settings.

Paths to exclude

Add these as folder exclusions:

• C:\Program Files\Trustity\TAO
• C:\ProgramData\Trustity\TAO
• C:\ProgramData\Trustity (covers portal CA and shared Trustity data)

Processes to exclude

Where process exclusions are available, add:

• tao-agent.exe
• tao-gui.exe
• tao-tray.exe
• tao-lock.exe
• tao-zerodevice.exe
• Trustity-Agent-Setup.exe

Intune / Defender for Endpoint (typical)

1. Open the Microsoft Defender or Endpoint security admin experience used by your tenant.
2. Create or edit an Antivirus / Exclusions policy targeted at the TAO pilot device group.
3. Add the path exclusions above.
4. Add process exclusions if the policy template supports them.
5. Assign the policy, wait for sync, then install TAO from Cloud Portal → Deployment.

For local pilot machines only (lab):

1. Open Windows Security → Virus & threat protection → Manage settings.
2. Under Exclusions, add the folders listed above.
3. Reboot or wait for Defender to reload policy, then install TAO.

Validation

On a pilot PC:

sc query TrustityAgent

Expect RUNNING. Then confirm the host is Online under Managed devices with the expected agent version.

If Setup was quarantined before exclusions:

1. Restore Trustity-Agent-Setup.exe and any tao-*.exe files from Defender protection history.
2. Confirm exclusions are active.
3. Re-run Setup from a freshly downloaded Deployment package (verify SHA-256 when shown).

Related links

• TAO antivirus and EDR exclusions
• Install TAO on Windows
• Troubleshoot an offline or stale agent