Folderexclusion

[serc09]

Hey.

Customer wants the folder "C:\Programme\ABC\IntClients\" to be excluded from scanning.

In VSE 8.7 policies i can add exclusions in

On-Access Default Processes Policies

On-Access Processes with low risk Policies

On-Access Processes with low high Policies

Do i have to exclude the folder in all these 3 policies? And how do i have to write it in:

C:\Programme\ABC\IntClients*

C:\Programme\ABC\IntClients\

C:\Programme\ABC\IntClients\*

Hope someone can help me.

Regards

serc09

P.S.: using ePO 4.5

[darkshyre · Accepted solution]

Yo

The easiest way to do this is to add in the On-Access default processes policies.

Then you should write it like this:

C:\Programme\ABC

then just tick the checkbox that says "include subdirectories"

[serc09]

Ok, but i don't want to exclude all subdirectories of C:\Programme\ABC .

C:\Programme\ABC\IntClients <<< will this exclude ...\IntClients\ and all subdirs?

[smalldog]

That's right! exclude ...\IntClients\ and all subdirs

[darkshyre]

C:\Programme\ABC\IntClients <<< will this exclude ...\IntClients\ and all subdirs?

Well if you've checked include all subdirs, it will exclude all subdirs under IntClients

[serc09]

THX alot for your answers.

Regards

ser09

[apoling]

Hello,

check out these two KB articles in connection with using exclusion patterns and techniques properly: KB54812 and KB57664

NB: a path should end in \ to mean that it is a folder.

Attila

[serc09]

THX Attila

VERY HELPFUL !!!!

serc09

[serc09]

Hey.

One more question to exclusions:

In VSE 8.7 policies i set under "On-Access Default Process Policies" to use different policies for processes with low/high risk.

When i now want to exclude all "**\*.xyz" files to be excluded, is it sufficient to add them under "Exclusions" in the "On-Access Default Process Policies", or do i have to exclude them in all 3 policies?

Regards

serc09

[apoling]

Hello,

the high and low risk policies have normally different OAS policy, e.g. some settings are used in high risk policy which are not used or not as stringently used in low risk. These policies apply to files opened, written, deleted, etc. by processes (or child processes thereof) under the HR or LR policy page. These, I'd say, might not inherit all the exclusions from the default policy.

So normally yes, exclusions should be specified for all level policies, unless you know that, say, low risk processes are processes that never open the *.xyz file (and any child processes thereof, too) or exclusions do not get inherited across default and HR-LR policies.

Attila