okay, i did what you ask me for: i have block the eventpaser.exe from script scans but i cloud not figure out how to do it on access scanning because there is low process and high process , which one of them i should use ?
I don't know how you do it but I use on access default policies to configure both high and low processes. In on access default I exclude eventparser.exe by pattern from read and write. Make sure you are on the exclusion section and working under servers and not workstations.
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.
Community Help Hub
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.