none
Exclude process - path needed?

    Question

  • Hi

    I am setting up System Center Endpoint Protection and I am working on exclusion policies. I have found these templates https://gallery.technet.microsoft.com/System-Center-Endpoint-65917b04/view/Discussions.

    When looking through the policies, I see, that some of them exclude processes by only using the file name, while others are excluded using the full path to the process.

    My question is - are the full paths needed, or is the file name enough? I can't seem to find a conclusive answer.

    Thanks in advance.

    Monday, March 12, 2018 7:54 AM

All replies

  • Based on https://social.technet.microsoft.com/Forums/forefront/en-US/6f64c23e-15b6-49bb-be2c-d170be963613/excluded-processes-does-endpoint-protection-2012-require-the-full-path-to-the-process-or-just-the?forum=FCSNext, you do not need the full path name to exclude a process; however, this is, security-wise, not the best option.

    Jason | https://home.configmgrftw.com | @jasonsandys

    Monday, March 12, 2018 3:27 PM
  • Based on https://social.technet.microsoft.com/Forums/forefront/en-US/6f64c23e-15b6-49bb-be2c-d170be963613/excluded-processes-does-endpoint-protection-2012-require-the-full-path-to-the-process-or-just-the?forum=FCSNext, you do not need the full path name to exclude a process; however, this is, security-wise, not the best option.

    Jason | https://home.configmgrftw.com | @jasonsandys

    I have seen forum posts that say both, but I would like to see some 'official' documentation.

    /Michael

    Tuesday, March 13, 2018 7:15 AM
  • There is none (at least none that I could find).

    You should be able to easily test this though.

    I did file a documentation issue after your initial post and my fruitless search though.

    Also note that *anyone* can file a documentation issue or recommend a change by simply clicking on the Edit button on docs.microsoft.com.


    Jason | https://home.configmgrftw.com | @jasonsandys

    Tuesday, March 13, 2018 5:27 PM
  • There is none (at least none that I could find).

    You should be able to easily test this though.

    I did file a documentation issue after your initial post and my fruitless search though.

    Also note that *anyone* can file a documentation issue or recommend a change by simply clicking on the Edit button on docs.microsoft.com.


    Jason | https://home.configmgrftw.com | @jasonsandys


    Thanks - I am not sure, how I can easily test it.
    Wednesday, March 14, 2018 7:38 AM