2

I'm using Azure's Batch services to unzip very large zip files before processing the unzipped files then deleting them. Unfortunately Windows Defender, which is preinstalled on the Azure VM's I'm using, will lock certain files so they can't be deleted - I imagine it's scanning them for viruses. I know it's Windows Defender locking the files as I ran a process monitor on the VM and isolated the process.

I've tried stopping Windows Defender as part of the batch job's preparation tasks but despite setting the elevation levels to Admin I still have no luck - access is denied.

Any help in disabling Windows Defender on an Azure VM via Batch services would be appreciated.

Bern
  • 121

3 Answers3

1

  1. Use these steps if you need to temporarily turn off Windows Defender Antivirus; however, if you do, your device may be vulnerable to threats.

    Open Windows Defender Security Center, then select Virus & threat protection > Threat settings. Turn off Real-time protection.

enter image description here Note: Scheduled scans will continue to run. However, files that are downloaded or installed will not be scanned.

  1. You can use Exclusions to let windows defender won't scan excluded files.

enter image description hereenter image description here

Community
  • 1
Sa Yang
  • 151
  • 6
1

It's not uncommon for security software to lock files while they're scanned and thus get in the way of deleting files. Instead of trying to defeat the scans (which is often brittle), I've successfully use a more adaptive approach where failed deletes are queued for retry later on.

Contextualized for working on Azure Batch ...

  • Choose a location (such as %AZ_BATCH_NODE_SHARED_DIR%) for a text file that lists the files queued for deletion - pending-deletes.txt. (You might want to initialize this as a zero byte file in your job prep task)
  • When your task completes, try to delete the input file as usual
  • If the deletion works, great.
  • If the deletion fails, append the full path of that file as a new line in pending-deletes.txt, queuing it for later cleanup.
  • As a last step in running the task, run a script (I'd write it in PowerShell) that iterates through pending-deletes.txt checking each file.
    • If the file has already gone, or can now be deleted, remove it from pending-deletes.txt
    • Otherwise leave it listed for another attempt later on
  • (Optional) Do a final delete run as a part of your job release task to finish clean up
Bevan
  • 2,913
0

You probably have a couple of options that don't involve stopping the service. Ideally, just add an exclusion for the files/folders in question with Add-MpPreference

Something more like outright disablement would be to try disabling realtime protection, rather than stopping the service. See https://superuser.com/a/1025308 . (But its probably better, security-wise, to just add an exclusion)

John Rusk - MSFT
  • 101