Is there a best practices guide floating around, in regards to configuring VSE for performance?
We are seeing some performance hits when doing things like launching Programs and Features or installing Windows Updates.
A good starting point to your question can be found here:
In particular, William Warren wrote this:
On Access Scanner - Improve Performance & Maintain Security (Blog) (https://community.mcafee.com/people/wwarren/blog/2015/03/23/on-access-scanner-im prove-performance-m...)
It may be useful to precisely determine where the performance issues occur. McAfee Profiler may help.
McAfee Profiler captures top processes and files that are accessed by the VirusScan Enterprise (VSE) On-Access Scanner (OAS). Based on the data collected, an administrator can choose files or processes to exclude from scanning to lessen the impact on the system.
Additional information can be found here:
Hope this is Helpful.
Thank you rmetzger, I will review those documents. I am also trying to get a copy of McAfee Profiler through our helpdesk since we don't have a direct McAfee number.
McAfee Profiler is a great tool.
Review standard VSE folder/file exclusion list; great starting point is found throughout these articles (every environment is different):
Consolidated list of VirusScan Enterprise exclusion articles Technical Articles ID: KB66909 Last Modified: 11/11/2016
Recommended exclusions for VirusScan Enterprise on Microsoft SQL Servers Technical Articles ID: KB67211 Last Modified: 5/6/2016
Recommended exclusions for VirusScan Enterprise on a Windows Domain Controller with Active Directory or File Replication Service Technical Articles ID: KB57308 Last Modified: 2/9/2016
Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows Article ID: 822158 - Last Review: 04/13/2015 16:36:00 - Revision: 20.1
VSE_880_Best_Practices_Guide (page 20 - 40)
Another way to find out what OAS is actually scanning is to review "On Access scan Statistics" - if you have the CMA installed on the workstation - right click agent in the system tray/choose quick settings - and watch
Take a look at "On-Access General Policies" <> "Maximum scan time:" <> "Enforce a maximum scanning time for all files" <> "Maximum scan time (seconds):"