Windows Defender stopping me from ejecting harddrive

No it does not add the drive. It is quite simple. It does nothing. I understand how to do it perfectly fine, windows does nothing when I do what you said to do. Will not allow me to add the drive.

@BWX, 

Sorry, without seeing what you are doing, I cant help you, I've been excluding the external drive from Defender for over a year without any issue.

After uninstalling Norton (as it came preinstalled after on my computer) I started to experience an issue, whenever I would try to eject my hard drive I would get an error, after looking in event viewer I saw an error talking about how msmpeng.exe was stopping it from ejecting. After researching I found out that this task was windows defender.

However I have tried everything to stop this from happening to no avail, Ive gone into its settings to turn it off and yet it still runs in the background still blocking be from ejecting my hard drive, attempting to close msmpeng.exe in task manager gives me an error that I dont have permission (with no way to change this) I have then followed guides about going into edit to make a file called disablelivespywareprotection (something like that) and now Im out of answers, Am I now forced to just unplug it unsafely or something? please help

 Hi harrison! 

     I haven't found any official solution but here is a simple trick:

          Go to Disk Management/Create or Format Partitions, in the lower part of the disk management window, find your disk, right click on it and click on 'offline' which will kill all the processes that the disk is running. After that, make it online again and then eject it as you would any other usb device.

@EsaAnjum, 

MS never came out with a fix for this bug.

But if you know the letter or letters usually assigned to the external drive(s) you can just exclude it from defender as shown here and then reboot, it excludes the root folder of the drive, and the eject works fine:

I also tried including the disk folder (E:) as you suggested, but still, Windows did not allow me to eject the hard disk. The only solution I have for this is to restart the laptop, but that is not a solution. Moreover, I am concern about what could happen with the data in the hard disk, as although I restart the computer I still have doubts if some data might be corrupted.

@Nekovolta, 

The exclusion list is not effective immediately, it requires a reboot to be activated.

It only works assuming that device letter(s) are the same when you insert the external drive(s).

Also it will only be effective if MsMpEng.exe is the cause of the problem.

You will need to check the Event Viewer, Windows Logs, System and see what the message for error 225 shows.

There could be other programs or processes that prevent the ejection, in that case the exclusion from defender will not help.

It works fine for me on 6 machines at Build 19042.662 and also Development Builds 20262.1010.

I've been using the exclusion for several months even before the defender platform was updated from 4.18.2009.7-0 to 4.18.2010.7-0.

The application \Device\HarddiskVolume3\ProgramData\Microsoft\Windows Defender\Platform\4.18.2010.7-0**MsMpEng.exe with process id 4380 stopped the removal or ejection**for the device  .....

Does not work. Cannot even add the drive since it is not a folder or file or process or file type. Those are the only options. When you try to add the entire drive, it does nothing. Nothing gets selected even if I type it in manually and press enter or select.

I already have that turned off

@_ATOmix_, 

As a workaround, see my post (Oct 18) about adding an exclusion in windows defender, on page 2 of this thread. 

Look at the drive letter(s) assigned to the external drive and add, for each external drive, to the exclusion list of folders in windows defender, then reboot.

That works for me when MsMpEng.exe is the cause of the block showing in event viewer.

(Assuming that the drive letter stays the same every time you insert the external drive.  😊)

I got an answer to this issue.  You do not have to safely remove USB drives anymore. If you look under disk management.  Right clik on the disc label in the  lower section. Select properties. Then select the policies tab. Under that is removal policy. Quick Removal(default) and Better Performance. As long as Quick Removal(default) is selected you can remove the drive anytime you want safely. I would  make sure the drive is not actually churning before pulling the plug. I've had no issues since someone explained this to me on Windows 10 help forums. https://www.tenforums.com/

Hope this helps.

 

Hi,

Useful info - but how do you make sure its 'not churning'.  Where is the 'stop churning' button?  I think mine is churning because of Windows Defender doing something.  When I do manage to safely eject the HD it spins down.  When it refuses to eject it won't spin down, and its churning.  When I pull it out when its spinning like this it makes a funny dying sound that doesn't sound normal.

I hope the UI expert who thought it sensible to have an 'eject device' button which then presents a 'Problem ejecting USB Mass storage device - device is currently in use, close any programs or windows that might be using the device and then try again' dialog box if the correct thing is just to pull the USB lead is 'needs improvement' on their annual review. 

Andy

@old-fogey, 

The problem with windows defender is not just for USB devices, the same happens with external SATA drives. This problem started with Windows 10 v 2004 and it is not happening with the same hardware with Version 1909, it is also not happening with insider build 20180 or other development builds.

It definitely looks like a bug caused by windows defender only with builds 19041 or 19042...

When the problem occurs, a restart of the PC seems to cure the problem temporarily and a clean eject is allowed before defender starts using the drive again.

The problem is definitely a bug it only happens with 19041 builds and MS should fix it.

[Machine Translation]

@RobertFlintstone

I appreciate your helpful answer on how to get around this problem. Analyzing your answer I found a Microsoft page that provides more details on this subject:

Change in default removal policy for external storage media in Windows 10, version 1809

@old_fogey

I also agree with you and I think this issue needs a Microsoft approach that gives the user more simplicity and security when removing a USB device. The user needs to have full confidence that they are following the correct procedure when removing a USB device, especially hard drives with high storage capacity.

@fg2001

I use Windows 10 Pro - Version 1909 - OS build: 18363.959 and this Windows Defender problem also occurs on my PC.