Question regarding allowing .exe files and how to whitelist them.

[User68214094]

I work in a school district and we have multiple (1000's) of false positives every day, and trying to weed through these is nearly impossible. The false positives stem from being in a security rule group rather than a balanced group. My supervisor is not willing to downgrade our security posture, so...

This file: "C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\1a9dbe36222431068d63284a515217f7\Microsoft.Management.Infrastructure.ni.dll" has over 4000 blocks today. From what I understand it is a windows update package. Since it isn't a .exe file, does anything work to whitelist it? Could I put "C:\Windows\assembly\NativeImages_v4.0.30319_64\" under OAS exclusions? Then check the subfolders box?

Is it best practice to use OAS exclusions or is it better to use DAC exclusions. Can it be done with C:\Windows\assembly\NativeImages_v4.0.30319_64\* in DAC or would that be effective?

There are others such as:

C:\Program Files (x86)\InTouch\OPOSPOSPrinter.ocx

C:\Program Files (x86)\Luidia\eBeam Device Service\eBeamDeviceServiceUI.exe

C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe

C:\Program Files (x86)\Objectif Lune\CPD\App\OLCS_Notifier.exe

C:\Program Files (x86)\Plustek\Plustek OpticPro A320E\DocuAction.exe

C:\Program Files (x86)\QuickTime\QTTask.exe

C:\Program Files (x86)\TI Education\TI-Nspire CX Navigator Teacher Software\bridgelinkserver.exe

that also get blocked regularly.

What is the best method to stop these false positives?

[Sivakumar1]

Hello @User68214094 . Thank you for posting t McAfee Enterprise Community. Please check on the article to add up exclusions for ATP,

https://docs.mcafee.com/bundle/endpoint-security-10.6.0-adaptive-threat-protection-product-guide-win...