← Back to Blog
📅 May 26, 2026 How-To 3 min read

How to Exclude KMSPico from Windows Defender

This is a necessary step before extracting KMSPico. Once you add the exclusion, Defender will leave the folder alone and you can run the activator without interruption.

Verified Download - KMSPico Official
KMSPico_Official_v10.2.0.rar
Archive password: 123456  ·  8.3 MB  ·  v10.2.0
Download KMSPico
Extract with WinRAR using the password above, then run as administrator. Works on Windows 10, 11, Server & Office.

Method 1: Folder Exclusion via Windows Security (Recommended)

This is the cleanest method - it excludes a specific folder rather than disabling Defender entirely.

  1. Press Win + S, search for Windows Security, and open it.
  2. Click Virus & threat protection.
  3. Scroll down to Virus & threat protection settings and click Manage settings.
  4. Scroll to Exclusions and click Add or remove exclusions.
  5. Click Add an exclusion → Folder.
  6. Navigate to and select the folder where you plan to extract KMSPico (e.g. C:\KMSPico).
  7. Click Select Folder. The exclusion is now active.

You can now extract the RAR archive into that folder and run the activator without Defender interference. You can remove the exclusion after activation if preferred.

Method 2: PowerShell (Fastest)

Open PowerShell as Administrator and run:

> Add-MpPreference -ExclusionPath "C:\KMSPico"

Replace C:\KMSPico with your actual extraction path. This takes effect immediately.

Method 3: Temporary Disable (Quick but Less Precise)

If you prefer to disable real-time protection temporarily:

  1. Open Windows Security → Virus & threat protection → Manage settings.
  2. Toggle Real-time protection to Off.
  3. Extract and run KMSPico.
  4. Re-enable real-time protection after activation completes.

Note: Windows will automatically re-enable real-time protection after a short period even if you turn it off manually. The folder exclusion method (Method 1) is preferred because it is permanent for that folder without weakening overall protection.

Why Defender Flags KMSPico in the First Place

Windows Defender uses behavioral rules that flag any software modifying the Windows Software Protection Platform (SPP). Since KMSPico directly interacts with SPP to install the GVLK key and activate Windows, it triggers the HackTool:Win32/AutoKMS heuristic. This is a policy classification - not evidence of malicious code. The same heuristic would flag a clean, custom-written volume licensing script.

Defender's PUA protection, in particular, is designed for aggressive enterprise environments and will quarantine tools that are perfectly legitimate for personal use. An exclusion is the correct technical response.

Related Guides

What is KMS? → Is It Safe? → Activation Methods → Troubleshooting →

Frequently Asked Questions

Defender classifies KMSPico as HackTool:Win32/AutoKMS because it modifies Windows licensing services. This is a false positive - the tool contains no harmful code.
Open Windows Security → Virus & threat protection → Manage settings → Exclusions → Add an exclusion → Folder. Select the folder where you extracted KMSPico.
Yes, temporarily disabling real-time protection to extract and run KMSPico is safe, provided you re-enable it immediately after. The folder exclusion method is preferred as it is more targeted.
The password is 123456. Use WinRAR to extract the archive and enter this password when prompted.

Understanding activation in context

To round out How to Exclude KMSPico from Windows Defender, it is worth setting it against how activation works more broadly, because the same handful of principles explain why the method is dependable and what to expect from it in practice.

Because the tool stands up a local host on the same machine, activation completes without depending on an outside server, which is what makes it fast and reliable even offline.

A one-click activation tool simply automates the steps you could run by hand: it installs the right generic key, points the client at a local host, and reports the licensed state when it finishes.

Extracting the archive and running it as an administrator is the key step, since the licensing write it performs needs elevated rights to succeed.

Running the activation step from an elevated context is essential, since the licensing service writes to a protected area and silently fails when it is called without administrator rights.

Because the process only writes licensing state and never patches system files, it is fully reversible with a single command and leaves the rest of the installation untouched.

Each activation grants a renewing period rather than a one-off stamp, so as long as the host stays reachable the licence refreshes itself automatically well before it would lapse.

The generic key involved does not carry an entitlement by itself; its only job is to tell Windows to reach a Key Management Service host, which performs the real activation once the client checks in.

Volume activation was designed by Microsoft for organisations that need to activate many machines without handling a separate key for each one, and that same mechanism is what makes this method dependable on a single PC.

A quick slmgr /xpr confirms whether the machine is licensed and when the current period renews, while slmgr /dlv shows the fuller channel and key detail when you need it.

Activation and Windows Update are independent of one another, so activating never blocks updates and a normal update never removes an activation that is renewing against a reachable host.

Matching the key to the exact edition is the detail that prevents most failures, as Windows treats Home, Pro, Education and Enterprise as separate products with separate keys.

Download KMSPico Official

Get the latest verified release and start activating Windows or Office in seconds - free and fully permanent.

Archive password: 123456

Download KMSPico RAR