MsMpEng.exe is found at path C:\ProgramData\Microsoft\Windows Defender\Platform\XYZ…\MsMpEng.exe with the XYZ being the current monthly version. This path changes monthly as new platform versions are released. The intial version at time of install can be found at C:\Program Files\Windows Defender\MsMpEng.exe.
What is the best practice for adding a safe process for program with a frequently changing path?
Example paths:
- C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2301.6-0\MsMpEng.exe
- C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2302.7-0\MsMpEng.exe
- C:\Program Files\Windows Defender\MsMpEng.exe