Kevin Beaumont on Twitter: "Here's another wild element. If you use Defender free with Windows Server or the paid Defender for Endpoint offering, they *automatically exclude* the IIS process (Exchange adds the Web Server role)- you can't see exclusions in product as it's automatic. https://t.co/PfeIli9Zdq https://t.co/QhNwxZRSuh" / Twitter