cancel
Showing results for 
Search instead for 
Did you mean: 

Question on On-Access Scanning

If a network path is excluded from on-access scanning on a server and that server grabbed a bad file say ransomware from that network path would Endpoint Security still detect it?
5 Replies
McAfee Employee vivs
McAfee Employee
Report Inappropriate Content
Message 2 of 6

Re: Question on On-Access Scanning

Hello,

Thanks for your post.

Please check the below links and that will help you.

https://docs.mcafee.com/bundle/endpoint-security-10.6.0-threat-prevention-client-product-guide-windo... 

https://docs.mcafee.com/bundle/endpoint-security-10.6.0-threat-prevention-client-product-guide-windo... 

https://docs.mcafee.com/bundle/endpoint-security-10.6.0-threat-prevention-client-product-guide-windo... 

If a network path is excluded from on-access scanning on a server and that server grabbed a bad file say ransomware from that network path would Endpoint Security still detect it?
If the files is doing any I/O operation and scan enabled is On in that case yes that will get scanned, If Scan is not enabled in that case no.

Scan only what you need to

Scanning some types of files can negatively affect system performance. For this reason, select these options only if you need to scan specific types of files. Select or deselect these options in the What to Scan section of the On-Access Scan settings.



Was my reply helpful?
If you find this post useful, Please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

 

McAfee Employee AdithyanT
McAfee Employee
Report Inappropriate Content
Message 3 of 6

Re: Question on On-Access Scanning

Hi @User72676622 

Thank you for your post. The above response is excellent in explaining what would happen when network files scanning is not enabled. However, in case of exclusion, I am afraid the answer may not be really that straight forward.

Why?

So by excluding a path, the first question that I would arrive at is, from where you are placing the exclusion?

What is the settings you have for On Access Scanning?

Excluding a network path is same as excluding a local path. The behavior of product would not vary from that aspect.

I would like to know what you are referring to by 


@User72676622 wrote:
that server grabbed a bad file say ransomware 

and this will definitely help me explain the end result accordingly. Looking forward to your response.

Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

Thanks and regards,
Adithyan T

Re: Question on On-Access Scanning

The exclusion would be added to an on-access EndSec policy in Standard and Low Risk process types.  It would look similar to \\fs-p9\blabla\system\import

 

McAfee Employee AdithyanT
McAfee Employee
Report Inappropriate Content
Message 5 of 6

Re: Question on On-Access Scanning

Hi @User72676622 

Under low risk policy, when you exclude a path, only those processes that are defined as low risk will be using these exclusions.

You have clearly mentioned that you are adding the exclusion for both Standard and Low risk processes.  All process that are not categorized as High/Low Risk are Standard Processes and hence when they act upon the ransomware file present in remote location (access/execute/modify), no scanning will be done.

However, When a process defined as high risk (eg: abc.exe) touches any files present on that location, a Scan will be done on the file and if this is a known ransomware, detection will definitely happen.

I sincerely hope this clarifies your question!

Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

Thanks and regards,
Adithyan T
McAfee Employee mmuthuga
McAfee Employee
Report Inappropriate Content
Message 6 of 6

Re: Question on On-Access Scanning

The file will be scanned if it was copied to the ENS machine from an excluded network path. The file on the excluded network path will not be scanned if the file was accessed, modified from the network location.

Was my reply helpful?
If you find this post useful, Please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community