Unable to eject USB drives due to Win Defender

Win 10 1909 Build:18363.859

Using Win 'Safe Remove' on my external USB drives no longer works due to an 'in use' failure. I installed "USB Safely Remove" and it displays a "cannot be stopped right now" failure:

Process Name & File name:
System
f:\$Extend\$RmMetadata\$Txf:$130:$INDEX_ALLOCATION

MsMpEng.exe
f:

Per a google search "MsMpEng.exe" is a Windows Defender program. I regularly remove/install drives so it's quite an annoyance to go through the process required.

Nothing I can find online has helped eliminate this issue. How do I get Defender to stop "Protecting" my USB drives?

Thanks for any assistance,

Tom

Add an exclusion in Windows Security for the drive letter of the USB.

Settings > Update & Security > Windows Security > Virus & threat protection > Manage settings > Exclusions

OldNavyGuy said:

Add an exclusion in Windows Security for the drive letter of the USB.
Settings > Update & Security > Windows Security > Virus & threat protection > Manage settings > Exclusions

Thanks for the suggestion.

I went to Exclusions and the choices were File or Folder -- no option for Drive Letter -- so I chose Folder. In Windows Explorer I selected the Root Folder, and opened "e:" for the Exclusion selection. The listed Exclusions now includes: "e:" so I presume the entire USB drive is now Excluded.

The "USB Safely Remove" program is still unable to remove the disk without the "Force Closed" option.

QUESTION: An Exclusion blocks Real-Time Protection as well as a Scan. Is this correct?

Tom

EdMcCauley said:

The "USB Safely Remove" program is still unable to remove the disk without the "Force Closed" option.

You use the word 'disk' and earlier said 'drives' so am I correct in assuming that this (these?) are USB HDDs rather than a Flash drive? If so then there other things that may keep a drive 'in use' other than a scan, Indexing for example.

One other culprit I have found responsible for the 'in use' error on attempting to eject a USB HDD is Task Manager. It's not consistent, in that just having Task Manager open doesn't usually prevent ejecting HDDs, but more often than not when I can't eject one then closing Task Manager is the solution.

Bree said:

You use the word 'disk' and earlier said 'drives' so am I correct in assuming that this (these?) are USB HDDs rather than a Flash drive? If so then there other things that may keep a drive 'in use' other than a scan, Indexing for example.

I was specifically referring to EXT USB HDD. I haven't tried a Flashdrive yet...
File Indexing was OFF according to Windows Settings. However, the following line in the USB Safely Remove program: f:\$Extend\$RmMetadata\$Txf:$130:$INDEX_ALLOCATION
had me convinced that this referred to File Indexing. After turning off Indexing via Cmd Prompt, ALL USB HDDs are ejected without a problem.

Thanks to all for the suggestions!

Sometimes I use a dirty trick to be able to eject some drives. Just do a chkdsk <drive:> /f and if you are in luck you may be able to eject it afterwards. It doesn't work always though.

This is a good thread, I've been through this in the past myself. It's a bit amazing to me that Windows 10 is so sloppy in this area after all this time. For some yrs I always disabled write caching and search indexing on all my external USB drives. And always excluded them from whatever Antivirus is running.

Still occasionally I'd have to run the Event Viewer and look for Warning 225 to track down a process that wouldn't release the USB. In the past there have been apps (like some Adobe stuff) that would do that. But some months back I kept getting the same offender which was MsMpEng.exe (a Windows Defender process).
Windows Computer Management->Event Viewer->Custom Views-Administrative Events
"-The application \Device\HarddiskVolume4\ProgramData\Microsoft\Windows Defender\Platform
\4.18.2104.14-0\MsMpEng.exe with process id 9496 stopped the removal or ejection for the
device USB\VID_xxxxxxxxxxxxxx"

Normally one would exclude the drive with Windows Defender. But in my case that was not possible due to the Windows Defender delegating that to Norton Antivirus and then graying out the ability to exclude it via Windows Defender. (I did exclude it in Norton)
But even though Windows would not allow me to exclude it via the Defender Windows STILL would not stop it's own MsMpEng.exe from blocking the release of the USB. Thanks to Win10's sloppiness I had to rely on a purchase of the Usb Safely Remove App to release the drive without shutting down or terminating MsMpEng.exe and wondering what that might cause. Sometimes Windows is amazing for lack of a better description.
I thank this thread though for covering this and also I thank the great little USB Safely Remove App for delivering a function outcome to my dilemma.

As said in above reply to this thread, when I first bought USB Safely Remove for awhile didn't have any issues with MsMpEng.exe. But after the last Win10 Update version 20H2 about a week ago, now even with USB Safely Remove after a mirror backup it gives the below (sometime for about 5 mins and last two times it refuses to go away after 30 mins). I have to shut down or let USB Safely Remove force close it. I use SyncbackSE mirror sync for years now to a USB 3.0 Toshiba drive (given the same drive letter in disk mgmt).
Below is the readout given by USB Safely Remove upon trying to eject the USB.
(Process Name)
System
F:\$Extend\$RmMetadata\$TxfLog\$TxfLogContainer000000000001
F:\$Extend\$RmMetadata\$Txf:$130:$INDEX_ALLOCATION
F:\System Volume Information\EfaSIDat\SYMEFA.DB
F:\$Extend\$RmMetadata\$TxfLog\$TxfLog.blf
F:\$Extend\$RmMetadata\$TxfLog\$TxfLogContainer000000000002
F:\System Volume Information\EfaSIDat\SYMEFA.DB
MsMpEng.exe
F:

Really confused as to why MsMpEng.exe is even running since I have Norton 360 installed and the subscription is still valid. Additionally (as said in previous post) all my USB drives are excluded in Norton as is the SyncBackSE app executable in Norton Admin Settings->Silent Mode Settings-> User Specified Programs. No write caching or indexing on any of the USB drives.
Perplexed why it's so interested in my mirror backup?
Only other thing that I can think of that's changed is this. I have all the NTUSER* files (that win10 keeps in my User Profile folder) unchecked on the SyncBackSE source selections. However I have "Any new files or folders" checked to included in new mirror runs. Then every now and again I go in and clean stuff up I don't want in the mirror settings.
I noticed after the last Win10 Update version 20H2 the SyncBackSE mirror has some of these NTUSER files in my backup. I deleted them from the backup and also unchecked them from the mirror. But MsMpEng.exe still seems interested in the USB they were copied to.
Lately Windows seems to be more hog wild than the NSA, and it's not only annoying it's a serious damper on performance of my workload at times if I don't disable updates on every boot.
Appreciate any comments or solutions.