Windows Defender stopping me from ejecting harddrive

Came here with the same problem on 19042.928.

Most of the other suggestions are destructive or will leave you dangerously undefended.

I set for better performance and the eject button works fine.

Flushing only took a few seconds and I had just overwritten ~20G.

The EJECTING_GET_OFF_THIS_DRIVE message is not getting to Defender if the drive is set to quick eject.

Maybe Defender is not listening in that case, which would seem reasonable - it's a readonly process.

If the drive is on laptop power, the performance setting is safe if you use eject.

BTW, in 19042.928, there is no safe to remove dialog. The drive symbol just disappears from the tray.

@stumit, 

That does not solve the problem for me, it has been like this for  about a year.

The only way that worked for me is by excluding the root Folder of the external drive in defender.

Keep in mind that recently, besides MsMpEng.exe there was another possible cause for people that use INTEL DSA, DSAService (32 bit) that prevented the ejection, so we need to check the event viewer to see the message on error 225 and check for the culprit, there could be other reasons too.

Not sure if they fixed that DSA problem in 19042.928, it was reported in FBH.

I don't disagree with anything posted here. I am still having some issues with my USB drive having corrupted files and or folders after coping new data to the drive. It could be because Defender is still running and maybe not clearing the new files as safe. I do not know. I've continued to look for ways to get around this issue. Maybe Defender is the problem. And where is msft in all of this??

I am having the same issue and have tried several things, but only restart helps.

Log Name:      System

Source:        Microsoft-Windows-Kernel-PnP

Date:          18/08/2020 13:55:05

Event ID:      225

Task Category: (223)

Level:         Warning

The application \Device\HarddiskVolume3\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.4-0\MsMpEng.exe with process id 2896 stopped the removal or ejection for the device USB\VID_0BC2&PID_2322\MSFT30NA8K2QEH.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Microsoft-Windows-Kernel-PnP" Guid="{9c205a39-1250-487d-abd7-e831c6290539}" />

    <EventID>225</EventID>

    <Data Name="ProcessId">2896</Data>

    <Data Name="ProcessNameLength">97</Data>

    <Data Name="ProcessName">\Device\HarddiskVolume3\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.4-0\MsMpEng.exe</Data>

    <Data Name="DeviceInstanceLength">36</Data>

    <Data Name="DeviceInstance">USB\VID_0BC2&PID_2322\MSFT30NA8K2QEH</Data>

  </EventData>

</Event>

@fg2001

I use Windows 10 Pro - Version 1909 - OS build: 18363.959 and this Windows Defender problem also occurs on my PC.

Jose, 

The quick removal for external drives is already set as default. That is not the issue, when eject is issued they should first stop the activity of windows defender on the drive and then eject correctly.

If you see the problem also with 1909, that means that they introduced the bug with some recent changes of the defender also in 1909.

I had 1909 for over a year and never had any problems with eject.

It all started for me with v 2004 in 5 different machines.

Also I don't get the problem with any insider development build up to build 20180.

[Machine Translation]

@ fg2001,

Thanks for the answer!

1. • Yes, Quick Removal by default is already OK. I posted the link just to show Microsoft's official information about this feature.

2) - "... If you see the problem also with 1909, that means that they introduced the bug with some recent changes of the defender also in 1909 ..."

Yes, the USB device removal problem and Windows Defender in version 1909 started recently. Before it worked correctly.

Hi Jose, 

Thanks for the confirmation. I just hope that MS comes out with a fix soon.

As I said earlier the problem is not just with USB devices, but also with external SATA devices.

That did not get rid of the code that is causing problems.

Go to Norton and get the removal software.

Did you go to Norton and get their removal software which removes all the code or just used Programs and features which does not?