You can use the ? and * wildcards to represent 1 or more characters when excluding files, folders, detection names and hashes, and potentially unwanted programs.You can use the ? and * wildcards to represent 1 or more characters when excluding files and folders from scanning.
Wildcard character | Name | Represents | Example |
|---|---|---|---|
? | Question mark | Single character in the exact location in the file, folder, or path name. You can use a single ? character as the root of a file path. For example, ?:\ABC matches the root-level ABC folder for all drives. | W?? excludes WWW, but doesn't exclude WW or WWWW. |
* | Asterisk | Multiple characters, except backslash (\). Doesn't cross folder boundaries.
| C:\Users\Will* matches path names, such as C:\Users\William, C:\Users\Willamina, and C:\Users\WillAnderson, but not subfolders of those names. |
** | Double asterisk | One or more of any characters, including backslash (\). Crosses folder boundaries. | C:\Users\Will** matches path names, such as C:\Users\William, C:\Users\Willamina, and C:\Users\WillAnderson and all their subfolders. C:\ABC\**\XYZ matches C:\ABC\DEF\XYZ and C:\ABC\XYZ. |
\**\ | One or more complete path components (including a single backslash), delimited by backslashes. | C:\**\Favorites\ matches any folder named Favorites on drive C.s. |
Wildcards can appear in front of a backslash (\) in a path. For example, C:\ABC\*\XYZ matches C:\ABC\DEF\XYZ.
Wildcard examples
Example | Description |
|---|---|
**\Temp\test.docx | Excludes a specific file in a folder named Temp anywhere on the system. |
**\test.docx | Excludes a specific file anywhere on the system. |
\**\test.docx | Excludes a specific file in any folder on a specific drive. |
Users\**\Documents\Microsoft User Data\ | Excludes any folder under Users and any folder under User Data, if you select Also exclude subfolders. |
C:\Documents and Settings\**\Favorites\ | Excludes the Favorites folder for all users. |
C:\**\Favorites\ | Excludes any folder named Favorites on the C: drive. |
**\Temp\** | Excludes the Temp folder in any location, on any drive, including:
|
**\Temp\*.tmp | Excludes any file with a .tmp extension in a folder named Temp anywhere on the system. |
**\*.html | Excludes any file with an .html extension anywhere on the system. |
C:\Windows\Temp*\inifile?.* | Excludes all files named inifileX, where X is any valid character for a file name, in any folder name beginning with Temp under C:\Windows. |
\**\*.tmp | Excludes all files with the .tmp extension (*.tmp) in any folder on a specific drive. |
D:\**\*.tmp | Excludes any *.tmp files on the D: drive. |
Environment variables in exclusions
In addition to wildcards, you can use system environment variables, such as %SystemRoot% in exclusions. Exclusions don't support user environment variables, such as %UserProfile%. The reason for this is that the on‑access scanner runs under the Windows LocalSystem account and can only access the system environment variables.