Preserve existing ASR exclusions when adding a PowerShell exception

Source facts

For global ASR exclusions, Set-MpPreference replaces the existing exclusion values with those supplied in the command. Microsoft documents Add-MpPreference for adding values without changing existing entries, and Remove-MpPreference for removing specified entries while retaining others. These global path exclusions apply across ASR rules. Microsoft Learn.

Applicability

Apply this check when an approved Windows ASR exception must be changed through PowerShell. Identify the governing management policy before making a local change, and keep the authorized scope in the change record.

DSE recommendation

DSE recommends treating an addition, a removal, and full replacement as different change intentions. Capture the approved before-state, select the operation that expresses the intended change, and have a reviewer compare the resulting list with the exception register. Reserve full replacement for a reviewed complete list rather than a command containing only the new exception.

Verification

In a controlled test, verify that the intended entry changes and unrelated approved entries remain as expected. Recheck the effective configuration after the normal management cycle. Retain the before-and-after lists in a restricted record and investigate any unexpected loss or reappearance before extending the change.

Official references

Microsoft Learn: Configure attack surface reduction (ASR) rules and exclusions. Source reviewed September 17, 2026.