Tune scan performance on Windows
Microsoft Defender real-time protection, or a third-party EDR, inspects every file the scanner opens. On a workstation with hundreds of thousands of files, a first scan can take hours, with Antimalware Service Executable using more CPU than the scan itself. The fix is one process exclusion for ggshield-py.exe, the process that runs the scan (ggshield.exe is only a launcher).
Exclude the scanner process from Microsoft Defender
Add a process exclusion for ggshield-py.exe with the path that matches your install method. The wildcards cover the user name and the versioned directory the install script creates.
| Install method | Process exclusion |
|---|---|
| Install script or ZIP (per user) | C:\Users\*\AppData\Local\Programs\ggshield\*\ggshield-py.exe |
| MSI (per machine) | C:\Program Files\GitGuardian\ggshield\ggshield-py.exe |
Write per-user paths with C:\Users\*: Microsoft Defender resolves %LOCALAPPDATA% and %USERPROFILE% to the system account's profile, not the user's.
Microsoft Defender no longer scans the files this process opens, so keep the exclusion to ggshield-py.exe and do not add path exclusions for the user profile. Behavioural detections in Microsoft Defender for Endpoint still apply.
Deploy the exclusion
- PowerShell
- Intune
- Group Policy
# Run as administrator. Keep the line for your install method.
Add-MpPreference -ExclusionProcess 'C:\Users\*\AppData\Local\Programs\ggshield\*\ggshield-py.exe'
Add-MpPreference -ExclusionProcess 'C:\Program Files\GitGuardian\ggshield\ggshield-py.exe'
If Intune or Configuration Manager also manages Defender exclusions, their policy overwrites local changes at the next startup.
Open Endpoint security > Antivirus > Create policy, select platform Windows and profile Microsoft Defender Antivirus exclusions, add the path under Excluded processes, then assign the profile to the device group that receives ggshield.
For another MDM, set the Policy CSP ./Device/Vendor/MSFT/Policy/Config/Defender/ExcludedProcesses to the same path.
Open Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Exclusions > Process Exclusions, enable the setting, and add one entry with the path as the value name and 0 as the value.
Check the result with Get-MpPreference | Select-Object -ExpandProperty ExclusionProcess, then time a scan with Measure-Command { ggshield machine report }.
Exempt the scanner from Arbitrary code guard
If an Exploit Protection policy applies Arbitrary code guard (ACG) to ggshield-py.exe, the scanner cannot use its regex JIT compiler and scans take several times longer, without any warning. ACG is off by default. Check, then exempt the process:
Get-ProcessMitigation -Name ggshield-py.exe # DynamicCode Enable: ON means ACG applies
Set-ProcessMitigation -Name ggshield-py.exe -Disable DynamicCode
To deploy the exemption fleet-wide, export it with Get-ProcessMitigation -RegistryConfigFilePath ggshield-exploit-protection.xml and upload the file in Intune under Endpoint security > Attack surface reduction > Exploit Protection, or distribute it through Group Policy. See Customize exploit protection.
Other antivirus and application control
- Third-party EDR (CrowdStrike Falcon, SentinelOne, Cortex XDR, Carbon Black): apply the same process exclusion for
ggshield-py.exewith the vendor's equivalent feature. When one of these is the primary antivirus, Microsoft Defender runs in passive mode, so configure the EDR instead. - AppLocker, App Control for Business, code integrity guard:
ggshield.exe,ggshield-py.exe, and the MSI are signed by GitGuardian, but the support files in the_internalfolder and the scanner plugin are not. Allow the install directory andC:\Users\*\AppData\Local\GitGuardian\ggshieldby path, and do not enable code integrity guard forggshield-py.exe.ggshield machine doctorfails when the scanner cannot load.
If scans are still slow
Record what Microsoft Defender scans during a run with its performance analyzer, as administrator:
New-MpPerformanceRecording -RecordTo "$env:TEMP\ggshield-defender.etl"
# Run ggshield machine report as the scan user, then press Enter here.
Get-MpPerformanceReport -Path "$env:TEMP\ggshield-defender.etl" -TopProcesses 10 -TopFiles 10
If ggshield-py.exe still leads the process list, the exclusion is not applied. Review the file paths in the report before sharing it with GitGuardian support. See Performance analyzer for Microsoft Defender Antivirus.
