diff --git a/kernel/api/router.go b/kernel/api/router.go
index ef65d32cc..ac5d37c3d 100644
--- a/kernel/api/router.go
+++ b/kernel/api/router.go
@@ -67,6 +67,7 @@ func ServeAPI(ginServer *gin.Engine) {
 	ginServer.Handle("POST", "/api/system/getWorkspaceInfo", model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, getWorkspaceInfo)
 	ginServer.Handle("POST", "/api/system/reloadUI", model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, reloadUI)
 	ginServer.Handle("POST", "/api/system/addMicrosoftDefenderExclusion", model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, addMicrosoftDefenderExclusion)
+	ginServer.Handle("POST", "/api/system/ignoreAddMicrosoftDefenderExclusion", model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, ignoreAddMicrosoftDefenderExclusion)
 
 	ginServer.Handle("POST", "/api/storage/setLocalStorage", model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, setLocalStorage)
 	ginServer.Handle("POST", "/api/storage/getLocalStorage", model.CheckAuth, getLocalStorage)
diff --git a/kernel/api/system.go b/kernel/api/system.go
index 14c986b32..604b3bdb7 100644
--- a/kernel/api/system.go
+++ b/kernel/api/system.go
@@ -50,6 +50,18 @@ func addMicrosoftDefenderExclusion(c *gin.Context) {
 	}
 }
 
+func ignoreAddMicrosoftDefenderExclusion(c *gin.Context) {
+	ret := gulu.Ret.NewResult()
+	defer c.JSON(http.StatusOK, ret)
+
+	if !gulu.OS.IsWindows() {
+		return
+	}
+
+	model.Conf.System.MicrosoftDefenderExcluded = true
+	model.Conf.Save()
+}
+
 func reloadUI(c *gin.Context) {
 	ret := gulu.Ret.NewResult()
 	defer c.JSON(http.StatusOK, ret)
@@ -283,6 +295,7 @@ func exportConf(c *gin.Context) {
 		clonedConf.System.Container = ""
 		clonedConf.System.IsMicrosoftStore = false
 		clonedConf.System.IsInsider = false
+		clonedConf.System.MicrosoftDefenderExcluded = false
 	}
 	clonedConf.Sync = nil
 	clonedConf.Stat = nil
diff --git a/kernel/model/elevator_windows.go b/kernel/model/elevator_windows.go
index 61bf46f41..5066f9ce8 100644
--- a/kernel/model/elevator_windows.go
+++ b/kernel/model/elevator_windows.go
@@ -21,11 +21,6 @@ package model
 import (
 	"errors"
 	"fmt"
-	"github.com/88250/gulu"
-	"github.com/siyuan-note/logging"
-	"github.com/siyuan-note/siyuan/kernel/util"
-	"golang.org/x/sys/windows"
-	"os"
 	"os/exec"
 	"path/filepath"
 	"runtime"
@@ -33,6 +28,12 @@ import (
 	"sync"
 	"syscall"
 	"time"
+
+	"golang.org/x/sys/windows"
+
+	"github.com/88250/gulu"
+	"github.com/siyuan-note/logging"
+	"github.com/siyuan-note/siyuan/kernel/util"
 )
 
 var microsoftDefenderLock = sync.Mutex{}
@@ -49,45 +50,33 @@ func AddMicrosoftDefenderExclusion() (err error) {
 		return
 	}
 
+	elevator := getElevatorBin()
+	if !gulu.File.IsExist(elevator) {
+		logging.LogWarnf("not found elevator [%s]", elevator)
+		return
+	}
+
 	installPath := filepath.Dir(util.WorkingDir)
-	psArgs := []string{"-Command", "Add-MpPreference", "-ExclusionPath", installPath, ",", util.WorkspaceDir}
-	if isAdmin() {
-		logging.LogInfof("current user is admin, add Windows Defender exclusion path [%s, %s]", installPath, util.WorkspaceDir)
-		cmd := exec.Command("powershell", psArgs...)
-		gulu.CmdAttr(cmd)
-		output, cmdErr := cmd.CombinedOutput()
-		if nil != cmdErr {
-			logging.LogErrorf("add Windows Defender exclusion path [%s, %s] failed: %s, %s", installPath, util.WorkspaceDir, cmdErr, string(output))
-			err = cmdErr
-			return
-		}
-	} else {
-		elevator := getElevatorBin()
-		if !gulu.File.IsExist(elevator) {
-			logging.LogWarnf("not found elevator [%s]", elevator)
-			return
-		}
-		logging.LogInfof("current user is not admin, use elevator to add Windows Defender exclusion path [%s, %s]", installPath, util.WorkspaceDir)
+	logging.LogInfof("use elevator to add Windows Defender exclusion path [%s, %s]", installPath, util.WorkspaceDir)
 
-		if !gulu.File.IsExist(elevator) {
-			msg := fmt.Sprintf("not found elevator [%s]", elevator)
-			logging.LogWarnf(msg)
-			err = errors.New(msg)
-			return
-		}
+	if !gulu.File.IsExist(elevator) {
+		msg := fmt.Sprintf("not found elevator [%s]", elevator)
+		logging.LogWarnf(msg)
+		err = errors.New(msg)
+		return
+	}
 
-		ps := []string{"powershell"}
-		ps = append(ps, psArgs...)
-		verbPtr, _ := syscall.UTF16PtrFromString("runas")
-		exePtr, _ := syscall.UTF16PtrFromString(elevator)
-		cwdPtr, _ := syscall.UTF16PtrFromString(util.WorkingDir)
-		argPtr, _ := syscall.UTF16PtrFromString(strings.Join(ps, " "))
-		execErr := windows.ShellExecute(0, verbPtr, exePtr, argPtr, cwdPtr, 1)
-		if execErr != nil {
-			logging.LogErrorf("add Windows Defender exclusion path [%s, %s] failed: %s", installPath, util.WorkspaceDir, execErr)
-			err = execErr
-			return
-		}
+	ps := []string{"powershell"}
+	ps = append(ps, []string{"-Command", "Add-MpPreference", "-ExclusionPath", installPath, ",", util.WorkspaceDir}...)
+	verbPtr, _ := syscall.UTF16PtrFromString("runas")
+	exePtr, _ := syscall.UTF16PtrFromString(elevator)
+	cwdPtr, _ := syscall.UTF16PtrFromString(util.WorkingDir)
+	argPtr, _ := syscall.UTF16PtrFromString(strings.Join(ps, " "))
+	execErr := windows.ShellExecute(0, verbPtr, exePtr, argPtr, cwdPtr, 1)
+	if execErr != nil {
+		logging.LogErrorf("add Windows Defender exclusion path [%s, %s] failed: %s", installPath, util.WorkspaceDir, execErr)
+		err = execErr
+		return
 	}
 
 	Conf.System.MicrosoftDefenderExcluded = true
@@ -130,11 +119,6 @@ func isUsingMicrosoftDefender() bool {
 	return cmd.Run() == nil
 }
 
-func isAdmin() bool {
-	_, err := os.Open("\\\\.\\PHYSICALDRIVE0")
-	return err == nil
-}
-
 func getElevatorBin() string {
 	elevator := filepath.Join(util.WorkingDir, "kernel", "elevator.exe")
 	if "dev" == util.Mode || !gulu.File.IsExist(elevator) {
diff --git a/kernel/model/sync.go b/kernel/model/sync.go
index 9f37a0fe2..91f978fea 100644
--- a/kernel/model/sync.go
+++ b/kernel/model/sync.go
@@ -475,6 +475,26 @@ func SetSyncProviderLocal(local *conf.Local) (err error) {
 	local.Endpoint = strings.TrimSpace(local.Endpoint)
 	local.Endpoint = util.NormalizeLocalPath(local.Endpoint)
 
+	absPath, err := filepath.Abs(local.Endpoint)
+	if nil != err {
+		msg := fmt.Sprintf("get endpoint [%s] abs path failed: %s", local.Endpoint, err)
+		logging.LogErrorf(msg)
+		err = errors.New(fmt.Sprintf(Conf.Language(77), msg))
+		return
+	}
+	if !gulu.File.IsExist(absPath) {
+		msg := fmt.Sprintf("endpoint [%s] not exist", local.Endpoint+" ("+absPath+")")
+		logging.LogErrorf(msg)
+		err = errors.New(fmt.Sprintf(Conf.Language(77), msg))
+		return
+	}
+	if util.IsAbsPathInWorkspace(absPath) {
+		msg := fmt.Sprintf("endpoint [%s] is in workspace", local.Endpoint+" ("+absPath+")")
+		logging.LogErrorf(msg)
+		err = errors.New(fmt.Sprintf(Conf.Language(77), msg))
+		return
+	}
+
 	local.Timeout = util.NormalizeTimeout(local.Timeout)
 	local.ConcurrentReqs = util.NormalizeConcurrentReqs(local.ConcurrentReqs, conf.ProviderLocal)