Verify from process monitor log if Windows Defender is scanning M-drive/installation directory

Overview

M-Files user guide states that M-Files virtual drive (default M:\) and M-Files installation folder (default C:\Program Files\M-Files) should be excluded in antivirus program in client computer. See detailed information for recommended exclusions from M-Files user guide:M-Files and Virus Scanning
If these exclusions are not applied in client computer, there could be various kind of unexpected behavior observed when using M-Files. For example, there could be random issues with check-in with objects, M-Files client application freezing and performance issues).

If anti-virus exclusions are not properly set, there could be also message "The process (name "MFClient.exe", ID XXXX) attempted to delete the file" in client computer Windows event log. Check this support article for further details about this: Troubleshooting "The process (name "MFClient.exe", ID XXXX) attempted to delete the file" error

Further investigation of what process is interfering M-Files client can be observed from process monitor logs.
Process monitor logs can be captured according to this support article. Using Process Monitor to Collect Logs (force.com)

This support article gives an example how to verify from process monitor logs if Windows default anti-virus program Windows Defender is reading M-Files virtual drive or M-Files installation directory.
 

Solution

Let's assume process monitor logs are saved from client computer over some operation according instruction support article link above. Process monitor log is saved from use case where some random unwanted behavior is observed and we want to verify from log that Windows Defender does not read M-Files virtual drive or M-Files installation folder.
Process name Windows Defender uses for scanning is "MsMpEng.exe".
Process monitor log can be checked in the following way:

1. Open saved process monitor log by double-clicking .PML file. Reset all log filters via reset button and select Ok.
2. Search for Windows Defender process "MsMpEng.exe" from entire log via CTRL+F. When the first hit is found, right-click "MsMpEng.exe" process name and select "Include 'MsMpEng.exe'". Now there are only process "MsMpEng.exe" filtered in the log.

3. Search again via CTRL+F from this filtered log virtual drive with "M:\" and M-Files installation folder "C:\Program Files\M-Files". (or similar matching to your M-Files installation)
4. If there are matching hits for these searches, Windows Defender is reading these directories.

In this case Verify exclusions set Windows Defender and set exclusions to either virtual drive or installation directory.
It would look like this in process monitor log:
(M:\ drive and M-Files installation directory C:\Program Files\M-Files in Path entry in log)
In case the anti-virus program in use is some other from Windows Defender, verify what is the process that is used.
Then use this process in filter in step 2 instead of 'MSMpEng.exe'.