Sign in
 
HomeProductsLibraryLearnDownloadsSupportForums
Microsoft Forefront TechCenter >
> 
> 
System Center 2012 Endpoint Protection - Excluded Processes, what exact behaviour of AV engine?

Answered System Center 2012 Endpoint Protection - Excluded Processes, what exact behaviour of AV engine?

  • Thursday, January 17, 2013 10:56 AM
     
     
    Sign In to Vote
    0

    Hello.

    Can anybody point me to appropriate documentation about exact behaviour of SC2012EP with excluded processes?

    My questions is:

    1. Excluded process will not be scan with real-time protection?
    2. Excluded process will not be scan with scheduled scan?
    3. Files accessed by excluded process will not be scan with real-time protection?
    4. Files created/modified by excluded process will not be scan with real-time protection?

    And another question:
    We have scheduled job, it runs very frequently, we want to exclude it from real-time scan on every start, but scan it weekly with scheduled scans. How  can we achieve it?
     

All Replies

  • Thursday, January 17, 2013 11:16 PM
     
     Answered
    Sign In to Vote
    0

    Hey 

    Thanks for the post ,

    1.  If You Excluded the process from the Real-time protection .

    2.  If You Excluded the process from the Schedule scan .

    3.  Same answer if the files excluded from scan real time/Schedule  - they will not scanned .

    4.  If You Excluded the create/modfy files's folder from scan . (the folder path) -  they will not scanned .

    For Your another question:

    Scheduled Scan it's the same as weekly  ,just create another one and disable the old one .

    I'd be glad to answer any question

     
  • Friday, January 18, 2013 10:12 AM
     
     
    Sign In to Vote
    0

    Hello Shuki Noy.

    Thanks for your reply.

    My questions was:  If I add some process to "Excluded processes" (see picture)

    1. Will it be scaned with real-time protection on process start?
    2. Will it be scaned with scheduled scan?
    3. Will files accessed by this excluded process be scaned with real-time protection?
    4. Will files created/modified by this excluded process be scaned with real-time protection?

    SC2012CM console - configure process exclusions


    • Edited by Vld_Sh Friday, January 18, 2013 10:12 AM
    •  
     
  • Friday, January 18, 2013 11:10 AM
     
     Answered
    Sign In to Vote
    0

    Hey

    1-2 . Exclusion Settings- > "Excluded processes" rely on any Type of Scan ,

    So for Your Question : no scan will start of any kind of type if it SET  to excluded .

    For files and folders:

    3-4 . You need to Set "Excluded files and folders" for No Scan .  

    If You Create or Modify new File or folder under existing Excluded Set .

    I'd be glad to answer any question


     
  • Monday, April 08, 2013 10:47 AM
     
     
    Sign In to Vote
    0

    how do i exclude a folder in multiple drives irrespective of drive letter

    ?:\Program Files\Exchsrvr

    or

    *:\Program Files\Exchsrvr

     
  • Tuesday, May 07, 2013 11:35 PM
     
     
    Sign In to Vote
    0

    Hi Aksridhar,

    To exclude the exchange install path, you can just use %exchangeinstallpath%