Exchange Server 2019 running slowly after recent Microsoft Defender update

Hi Visham Pati

Thank you for reaching out to Microsoft Q&A

Based on my research, this unexpected behavior often occurs after antivirus updates in Exchange environments. Microsoft Defender’s enhanced real-time scanning can sometimes scan critical Exchange components like database files (.edb), log files (.log), queue files (.que), or processes such as MSExchangeTransport.exe and MSExchangeIS.exe.

Although Defender updates don’t usually reset exclusions (since they’re stored in the registry), problems arise if exclusions were incomplete, overridden by Group Policy, or not fully aligned with newer scanning behavior. The result is periodic performance slowdowns without clear error logs, as the impact comes from background resource contention rather than direct failures.

To solve these behaviors, you can start by checking your current Microsoft Defender exclusions using PowerShell. Open an elevated session and run:

Get-MpPreference | Select-Object ExclusionPath, ExclusionProcess, ExclusionExtension

This lets you confirm whether all key Exchange folders (like %ExchangeInstallPath%Mailbox), processes, and file extensions are properly excluded.

Additionally, if any exclusions are missing, reapply Microsoft’s recommended settings using their automated script. Download and run Set-ExchAVExclusions.ps1 from https://microsoft.github.io/CSS-Exchange/Setup/Set-ExchAVExclusions/ in the Exchange Management Shell. This script automatically adds all the necessary exclusions and logs the changes in C:\SetExchAvExclusions.log.

After that, restart the affected services:

Restart-Service MSExchangeTransport  
Restart-Service MSExchangeIS

Then monitor your server for 24–48 hours and check Perfmon for queue length and CPU usage, and review Defender event logs for any scan-related slowdowns.

If performance issues persist, try temporarily disabling real-time protection for testing, make sure your Exchange server has the latest Cumulative Update, and if needed, open a Microsoft Support ticket with your exclusion audit logs.

Best regards

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".     

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.