cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ken_hp
Level 7
Report Inappropriate Content
Message 1 of 2

Questions on Low Risk Profile and Exclusions

I understand the concept of the Low Risk/High Risk profiles. It was always explained to me that the exclusions in the Standard Profile applied to any processes not explicitly added to either the Low Risk or the High Risk Profile.

1. The KB's say to add the same exclusions you have in the Standard Profile to the Low Risk profile. Why would that be necessary if the Low Risk processes isn't accessing those files/folders?

2. A previous admin had the process in the Standard Profile but still saw performance issues and in Profiler. We added the process to the Low Risk Profile and still see the issue and in Profiler. Profiler shows the process as "Default [VSE name for Standard]" instead of "Low Risk". If the process is in both profiles, does ENS create a composite rule set and the higher risk profile (e.g., Standard over Low) prevail?

3. Low Risk only accepts files (no folders) but can full paths/wildcards be used (e.g., **\processname.exe   ?

4) If the Low Risk Profile (or the process exclusions) is set to not scan on Read or Write, are exclusions needed since no scanning should be taking place on files accessed by the process?

5) Lastly, if a folder was added as an exclusion for processa.exe and we later add processb.exe, will the earlier exclusions have any affect on the processb.exe scanning?  What if processb.exe was added with don't scan on read or write?

Thanks!

1 Reply
Pravas
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 2

Re: Questions on Low Risk Profile and Exclusions

Hi @Ken_hp,

Please find my response below.

1. The KB's say to add the same exclusions you have in the Standard Profile to the Low Risk profile. Why would that be necessary if the Low Risk processes isn't accessing those files/folders?

You're right, its not required if the files/folders are not being scanned by Low risk process.

2. A previous admin had the process in the Standard Profile but still saw performance issues and in Profiler. We added the process to the Low Risk Profile and still see the issue and in Profiler. Profiler shows the process as "Default [VSE name for Standard]" instead of "Low Risk". If the process is in both profiles, does ENS create a composite rule set and the higher risk profile (e.g., Standard over Low) prevail?

As far as I'm aware, a process cannot be included in both Profiles. You can only use either High or Low Risk.

3. Low Risk only accepts files (no folders) but can full paths/wildcards be used (e.g., **\processname.exe ?

Yes WildCard exclusions can be used in Low Risk Profile as well.

4) If the Low Risk Profile (or the process exclusions) is set to not scan on Read or Write, are exclusions needed since no scanning should be taking place on files accessed by the process?

Exclusions are not required if the scanning has been switched off.

5) Lastly, if a folder was added as an exclusion for processa.exe and we later add processb.exe, will the earlier exclusions have any affect on the processb.exe scanning?  What if processb.exe was added with don't scan on read or write?

If Processa.exe & Processb.exe are added to Low Risk profile. Path exclusions will be applied to both processes.

Please read more about these topics in the link below.

https://kc.mcafee.com/corporate/index?page=content&id=KB55139

Thanks

Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community