Scenario is that our security team needs Windows defender running with "real time protection ON". The moment we turned it on, we notice deterioration in performance. The application is an old java swing JNLP ie when it starts, it downloads a lot of jar files into c:\users\photonuser\.cache folder. I am struggling to exclude this folder from defender scan rules

As per below link ,it seems I cant add %USERPROFILE% as it wont point to c:\users\photonuser and bizarre is that if I try to add a exclusion like "%USERPROFILE\.cache" image builder snapshotting fails in sysprep phase. ( AWS couldnt help find any root cause and it takes 12 hours to fail )

Would like to know what /how you guys managed to configure Windows defender in appstream

thanks in advance

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/common-exclusion-mistakes-microsoft-defender-antivirus?view=o365-worldwide

Using incorrect environment variables as wildcards in the file name and folder path or extension exclusion lists

Microsoft Defender Antivirus Service runs in system context using the LocalSystem account, which means it gets information from the system environment variable, and not from the user environment variable. Use of environment variables as a wildcard in exclusion lists is limited to system variables and those applicable to processes running as an NT AUTHORITY\SYSTEM account. Therefore, don't use user environment variables as wildcards when adding Microsoft Defender Antivirus folder and process exclusions. See the table under System environment variables for a complete list of system environment variables.