Disable automatic cleanup of PUA

Hi Lukas_lzs,

Thanks for reaching out to the Sophos Community Forum. 

It's not currently possible to prevent the automatic cleanup of PUA's. Additional information on remediation options can be found at the following link. 
- Threat Protection Policy > Remediation

I'd suggest creating a new Threat Protection policy for devices which will require access to these admin tools. You'll need to create an exclusion of the type "Potentially Unwanted Application (Windows/Mac)". The name you see referenced in the detection event will also be important, as this needs to be populated into the exclusion UI. 

For example, in the following detection, you will need to enter "PsExec" as opposed to the path or exe name. 

Hi Lukas_lzs,

Thanks for reaching out to the Sophos Community Forum. 

It's not currently possible to prevent the automatic cleanup of PUA's. Additional information on remediation options can be found at the following link. 
- Threat Protection Policy > Remediation

I'd suggest creating a new Threat Protection policy for devices which will require access to these admin tools. You'll need to create an exclusion of the type "Potentially Unwanted Application (Windows/Mac)". The name you see referenced in the detection event will also be important, as this needs to be populated into the exclusion UI. 

For example, in the following detection, you will need to enter "PsExec" as opposed to the path or exe name. 

Thanks for the fast reply. 
Although i had hoped for another answer, this „fixed“ the problem. 
thanks again.

No problem at all. 

I can see a feature request we've received for your desired behaviour to be added as an option. If you can provide me with your company details via private message, I'd be happy to add this to your account record. This helps our product teams better understand the features customers would like to see implemented.

There is no way to turn off PUA detection at all or to create an exception with a wildcard instead of a specific PUA name?

It is a problem for us (or one of our customers) we are unable to:

1. turn off PUA detection or

2. create a wildcard exception for a folder or

3. turn off automatic PUA cleanup.

Thank you

If you'd like to create a more generic exclusion for PUA files, this will need to be done from the "Allowed Applications" page under "General Settings". 
- Allowed applications

I was able to designate a folder using the following exclusion. While this is not recommended due to its inherent risks, you may be able to adjust the exclusion to be more specific. You can also specify individual exe files you wish to exclude.
- C:\Users\CLIENT-04\Downloads\PUAs\*.exe

Using wildcards and variables will also help you to provide a more specific folder where these applications must reside on a device as well. 
- Wildcards & Variables