0

I can't safely eject/remove my USB hard drive, because Windows Defender is accessing it all the time:

Die Anwendung \Device\HarddiskVolume6\ProgramData\Microsoft\Windows Defender\Platform\4.18.2103.3-0\MsMpEng.exe mit der Prozess-ID 14472 hat das Entfernen oder Auswerfen für das Gerät USB\VID_174C&PID_5106\00000000000000000000 beendet.

I tried everything from here, but nothing works. Also Process Explorer doesn't let me kill it. I can't stop this service. I need to stop it now and I can't reboot. Otherwise I'll loose the data on the disk. Also the solution has to work on the latest Windows 10 version 20H2. I won't execute random commands from the internet without understanding or knowing what it does (also not many user reporting that it works). There should be an option to undo the operation afterwards.

What can I do?

testing
  • 879
  • 8
  • 23
  • 40
  • Here is a [related thread](https://answers.microsoft.com/en-us/windows/forum/all/windows-defender-stopping-me-from-ejecting/0798ea73-d511-415c-b06c-a967d8d2a5e4?page=4) with no solution ... – testing Apr 04 '21 at 00:11
  • 2
    Does this answer your question? [Disable Windows Defender in Windows 10](https://superuser.com/questions/947873/disable-windows-defender-in-windows-10) – Moab Apr 04 '21 at 02:06
  • @Moab: In the group policy there is no *Windows Defender* entry. Only *Windows Defender SmartScreen* and this is something different. Other solutions looks interesting, but they are going very deep into the OS and doing something fatal is very likely. Seems there is no easy way to disable it, despite being the "Administrator". Also I can only choose a solution, which do not require a restart. So then there is not much left ... – testing Apr 04 '21 at 10:37
  • "doing something fatal is very likely" only if you don't follow instructions, I have done this to all 4 of my W10 PC's with no issues. – Moab Apr 04 '21 at 16:46
  • @Moab: [Your solution](https://superuser.com/a/1590934/113508) requires a reboot ... I‘m talking about things like [this](https://superuser.com/a/1213485/113508) – testing Apr 05 '21 at 09:19
  • Every one of the old tricks no longer work in 20H2 – Moab Apr 05 '21 at 18:06

1 Answers1

1

Save any documents, close all applications, log off (not restart), remove the drive when logged off (you can do so safely).

Log back on and the drive is now safely removed.

Log off will ask if an app is open and let you save your documents. This works in a multi user environment.

John
  • 46,167
  • 4
  • 33
  • 54
  • Are you sure? One time I destroyed the whole data on the disk by restarting the PC (which was my last option) ... – testing Apr 04 '21 at 00:17
  • Save all data and close all apps. You can do that before logging off. Logging off is not restarting. I have a USB drive and have done this. – John Apr 04 '21 at 00:18
  • I did this now. Currently, it seems that it worked. But when can you do this? You don't know when a process is reading or writing ... – testing Apr 04 '21 at 00:28
  • If documents have been saved and applications closed then the app processes will not be writing. Just be sure all is saved before logging off. And you did note that it worked. So that is the method you need to use. – John Apr 04 '21 at 00:30
  • One time (didn't know which process it was) I had the issue that there was no application/document open (only some background processes apparently). And then I clicked restart and the whole data on the drive was destroyed ... That's the reason I'm asking. – testing Apr 04 '21 at 00:35
  • 1
    Just make sure all apps are closed. Logging off will ask if there is an app open. That is why I suggest log off and not restart. – John Apr 04 '21 at 00:38