cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
shocko
Level 10
Report Inappropriate Content
Message 1 of 3

On-Access General Exclusions on Windows Servers

Jump to solution

Guys, running a windows estate of ~ 1000 servers. On-Access scan is disabled and I want it enabled for security. That said, wondering what experienced people are doing around:

  • Low risk processes setup
  • OAS exclusions
  • ODS exclusions

Microsoft publish this list of recommendations and a baseline one for Windows Servers here. Is there any guide on how to set them up specif to VSE or ENS though? MS mention exclusions but not sure if that means (in the VSE/ENS content) to use low risk processes that do not scan on read/write or exclude for all processes and ODS etc. 

 

Anyone with experience managing VSE/ENS on a large server estate would be much appreciated. Particularly how you justify risk of exclusions etc. 

1 Solution

Accepted Solutions
Former Member
Not applicable
Report Inappropriate Content
Message 2 of 3

Re: On-Access General Exclusions on Windows Servers

Jump to solution

Hi @shocko 

For ENS:

How to improve performance with Endpoint Security 10.x
https://kb.mcafee.com/agent/index?page=content&id=KB88205

Consolidated list of Endpoint Security and VirusScan Enterprise exclusion articles
https://kb.mcafee.com/agent/index?page=content&id=KB66909

Here are the important take away’s from these KBs:

  • ENS performance can be improved many ways i.e.:
    Utilizing low/ high risk processes, disabling archive scanning, keeping exclusions to a minimum, using scan avoidance  
  • If using ENS OAS “Let McAfee Decide”,  you can benefit from the AMCORE trust model.
    What is the AMCORE trust model?
    The AMCORE trust model means that you no longer need A LOT of the manually set exclusions as you used to in VSE. All the exclusions listed in KB66909 and many more are included in the trust model and no longer need to be added manually. In fact adding them manually is duplicating the efforts and can resort in negative performance impacts.
    For full details, read: https://community.mcafee.com/t5/Documents/Explanation-of-AMCore-Trust-Model-v1p3-pdf/ta-p/550630

    What are the benefits of leveraging the scan avoidance?
    Performance, performance, performance. Security, Security, Security 😊 – where manually setting exclusions works in a very rigid black and white way – it’s either excluded or not, the AMCORE trust excludes the items in a more intelligent way, it ensures that security is upkept whilst allowing for the performance benefits.
  • Reducing the amount of exclusions you use also is beneficial for security and performance. You should look to take the approach of only apply what’s needed (and yes, this requires configuring different policies for different systems), keep the amount of exclusions to absolute minimum.

The above is only relevant for ENS OAS. For ODS you may need to add specific exclusions but typically the whole point of running the ODS task is to scan those locations that you've excluded from OAS scanning.

 

VSE is less intelligent than ENS. You should use low/ high risk profiles as with ENS so you can properly define a process exclusion. The main important thing to remember is that is you exclude i.e. test.exe within the default exclusions, this is a file exclusion only - the process will still be scanned. To exclude the process from being scanned, you need to define it as a low risk process and potentially disable scanning for low risk processes. For VSE systems you will need to add the recommended MS exclusions. However I would encourage a migration of those systems to ENS to benefit from the new features and scan architecture.

View solution in original post

2 Replies
Former Member
Not applicable
Report Inappropriate Content
Message 2 of 3

Re: On-Access General Exclusions on Windows Servers

Jump to solution

Hi @shocko 

For ENS:

How to improve performance with Endpoint Security 10.x
https://kb.mcafee.com/agent/index?page=content&id=KB88205

Consolidated list of Endpoint Security and VirusScan Enterprise exclusion articles
https://kb.mcafee.com/agent/index?page=content&id=KB66909

Here are the important take away’s from these KBs:

  • ENS performance can be improved many ways i.e.:
    Utilizing low/ high risk processes, disabling archive scanning, keeping exclusions to a minimum, using scan avoidance  
  • If using ENS OAS “Let McAfee Decide”,  you can benefit from the AMCORE trust model.
    What is the AMCORE trust model?
    The AMCORE trust model means that you no longer need A LOT of the manually set exclusions as you used to in VSE. All the exclusions listed in KB66909 and many more are included in the trust model and no longer need to be added manually. In fact adding them manually is duplicating the efforts and can resort in negative performance impacts.
    For full details, read: https://community.mcafee.com/t5/Documents/Explanation-of-AMCore-Trust-Model-v1p3-pdf/ta-p/550630

    What are the benefits of leveraging the scan avoidance?
    Performance, performance, performance. Security, Security, Security 😊 – where manually setting exclusions works in a very rigid black and white way – it’s either excluded or not, the AMCORE trust excludes the items in a more intelligent way, it ensures that security is upkept whilst allowing for the performance benefits.
  • Reducing the amount of exclusions you use also is beneficial for security and performance. You should look to take the approach of only apply what’s needed (and yes, this requires configuring different policies for different systems), keep the amount of exclusions to absolute minimum.

The above is only relevant for ENS OAS. For ODS you may need to add specific exclusions but typically the whole point of running the ODS task is to scan those locations that you've excluded from OAS scanning.

 

VSE is less intelligent than ENS. You should use low/ high risk profiles as with ENS so you can properly define a process exclusion. The main important thing to remember is that is you exclude i.e. test.exe within the default exclusions, this is a file exclusion only - the process will still be scanned. To exclude the process from being scanned, you need to define it as a low risk process and potentially disable scanning for low risk processes. For VSE systems you will need to add the recommended MS exclusions. However I would encourage a migration of those systems to ENS to benefit from the new features and scan architecture.

View solution in original post

bodysoda
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 3 of 3

Re: On-Access General Exclusions on Windows Servers

Jump to solution
This is one of the good explanations I've so far seen online. Thanks
In case above information was useful or answered your question, please select "Accept as Solution" in my reply, or give a Kudo. Thanks!
You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community