python .\test-defender-exclusion-v3.py
approval/asked then allowed: 1. Yes, proceed (y). processId 89326. durationMs 24472. exitCode 0.
{"event": "runtime", "pid": 38676, "python": "3.12.10", "elevated": false}
{"event": "elevationRequest", "method": "ShellExecuteExW/runas"}
{"event": "elevationExit", "exitCode": 0}
{"event": "runtime", "pid": 59108, "python": "3.12.10", "elevated": true}
{"event": "elevation", "elevated": true, "pid": 59108}
{"event": "effectObservation", "phase": "baseline", "state": "ABSENT"}
{"event": "nativeResult", "api": "Add-MpPreference", "result": 0}
{"event": "effectObservation", "phase": "afterAdd", "state": "PRESENT"}
{"event": "effectComplete", "action": "add", "verified": true}
{"event": "nativeResult", "api": "Remove-MpPreference", "result": 0}
{"event": "effectObservation", "phase": "afterRemove", "state": "ABSENT"}
{"event": "summary", "status": "complete", "failure": null, "cleanupErrors": []}
Desktop measurement is the host red PRESENT hold, not this stdout.