Chris Nackers Blog

ConfigMgr and MDT Deployment Solutions

Useful Blogs

User Groups

SMS/ConfigMgr Anti-Virus exclusion considerations

In addition to Shaun’s posting here:

http://myitforum.com/cs2/blogs/scassells/archive/2007/05/14/what-anti-virus-scanning-exclusions-should-be-considered-for-system-and-servers.aspx

I wanted to post the additional information I’ve found for anti-virus exclusions… nothing pretty just a quick list of the information I’ve found.  This is merely a collection of information, not a best-practices guide.  Hopefully the information below will help you to develop the best setup for your environment.

-Chris

 

Systems Management Server (SMS) 2 & 2003

(dependent on SQL Server)

http://support.microsoft.com/?id=327453

http://support.microsoft.com/?id=871161

-

install.map

C:\SMS

Prevents contention for install.map data file.

   

*.adc, *.box, *.ccr, *.cfg, *.cmn, *.ct0, *.ct1, *.ct2, *.dat, *.dc, *.ddr, *.i*, *.ins, *.ist, *.job, *.lkp, *.lo_, *.log, *.mif, *.mof, *.nal, *.ncf, *.nhm, *.ofn, *.ofr, *.p*, *.pcf, *.pck, *.pdf, *.pkg, *.pkn, *.rpl, *.rpt, *.sca, *.scd, *.scu, *.sha, *.sic, *.sid, *.srq, *.srs, *.ssu, *.svf, *.tmp, *.udc

C:\SMS\Inboxes

(exclude file types or all files for all sub folders under C:\SMS\Inboxes, with the exception of C:\SMS\Inboxes\clicomp.src and C:\SMS\Inboxes\colfile.box folders).

Site Server inboxes (only applies to servers providing Site Server services)

   

*.log

C:\SMS\Logs

SMS Logs

   

*.*

C:\SMS\Netmon\i386\captures

C:\SMS\Netmon\i386\experts

Netmon capture and data files

   

-

C:\SMS\CAP_%SMSSiteCode%

(where %SMSSiteCode% is the three character site code in SMS)

(exclude file types or all files for all sub folders under C:\SMS\Inboxes)

Client Access Point inboxes (CAP) inboxes (only applies to servers providing CAP services)

   

*.* /s

C:\SMSPKG folder (this is typically the drive that contains the most available disk space)

Distribution manager stores compressed copy of package.

   

*.tmp

C:\

(by default this is the same drive as the on that contains the above SMSPKG folder)

Distribution manager compresses temporary copy of package.

   

*.msg

*.que

*.xml

C:\SMS_CCM\ServiceData

Management Point (MP) (only applies to SMS 2003 Management Points)

SMS 2003 Clients (running ITMU)

-

wsusscan.cab /s

%SystemRoot%\SoftwareDistribution\Scanfile

The Windows Update catalog is a big file and can cause performance issues when copied around on the client machine if AV is set to scan inside archived files.

Because the Wsusscan.cab file contains several nested cabinet files, excluding the Wsusscan.cab file itself is not typically sufficient to combat the high CPU use unless you can also specify to exclude its contents.

     

%SystemRoot%\system32\CCM\Cache

SMS client cache folder

     

%SystemRoot%\system32\VPCache

Package ID folder for the inventory tool

 

And here is another list someone had put together:

SMS 2003 McAfee Settings

Low-Risk Processes

Processes

CCMEXEC.exe

SITECOMP.exe

SLPEXEC.exe

SMSDBMON.exe

SMSEXEC.exe

Scan Files

Scan on Data Read - NO

Scan on Data Write - NO

Exclusions

None


Default Processes

Processes

N/A

Scan Files

Scan on Data Read - YES

Scan on Data Write – NO

Exclusions

Files of Type:

BAK

EDB

MDF

TMP

MIF

SMS

CTL

JOB

NDF

TRN

NAL

TCF

DAT

LDF

PCK

LDF

NCF

 

DBF

LO_

PSD

CFG

OFR

 

DMP

LOG

SRS

CHG

PKG

 

File Paths

Path

Exclude Subfolders

*System32\WBEM

Yes

D:\SMS

Yes

D:\SMS_CCM

Yes

E:\CAP_ENT

Yes

E:\SMSBackup

Yes

E:\SMSPKG

Yes

Pagefile.sys

 

Windows file protection

 

*SMS_CCM\ServiceData*

 

* SMS\Logs*

 
   

*SMS\Inboxes*

 

** We need some exclusions for SQL ***


High-Risk Processes

Processes

N/A

Scan Files

Scan on Data Read - YES

Scan on Data Write – NO

Exclusions

Files of Type:

BAK

EDB

MDF

TMP

MIF

SMS

CTL

JOB

NDF

TRN

NAL

TCF

DAT

LDF

PCK

LDF

NCF

 

DBF

LO_

PSD

CFG

OFR

 

DMP

LOG

SRS

CHG

PKG

 

File Paths

Path

Exclude Subfolders

*System32\WBEM

Yes

D:\SMS

Yes

D:\SMS_CCM

Yes

E:\CAP_ENT

Yes

E:\SMSBackup

Yes

E:\SMSPKG

Yes

Pagefile.sys

Yes

Windows file protection

Yes

*SMS_CCM\ServiceData*

Yes

* SMS\Logs*

Yes

*SMS\Inboxes*

Yes

   

*** We need some exclusions for SQL ***

Comments

No Comments