This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Local Exclusions vs EC exclusions

If we apply on-access exclusions on a machine which are in addition to the on-access exclusions within the policy pushed via Enterprise Console, should they remain after the AV policy is pushed from Enterprise Console?

Obviously the machine will show as differing from policy, but will the local exclusion be removed if we ask the computer to Comply with AV Policy?

I have come across an instance where I have added exclusions locally and returned a week later to find that those exclusions have disappeared and only the EC policy exclusions are in place.

Thanks for any help

This thread was automatically locked due to age.

0 jak over 7 years ago

They would be removed when the client receives the policy from the management server.

Are you trying to do anything in particular?

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel
0 Papadug over 7 years ago in reply to jak

Thanks Jak,

We have a VERY old version of the Enterprise Console (don't ask!) which doesn't have the ability to add processes to the on-access exclusions, only files, folders and drives.

For one of our systems, we need to make sure that a number of processes aren't being scanned so I had added them to the local machines, but have since discovered they disappeared.

If we don't push the policy from EC to the machine, would the exclusions remain?

Thanks again
Cancel
Vote Up 0 Vote Down

Cancel
0 jak over 7 years ago in reply to Papadug

SAV supports 2 forms of exclusions:

1. The new exclusions you set in the client UI and at the management console.

2. Registry (legacy)

The registry ones are limited to the process name and you can only specify around 30. Details here:

https://community.sophos.com/products/endpoint-security-control/f/sophos-endpoint-software/4011/how-to-exclude-a-process

The registry ones are read by the driver and do not effect policy compliance.

They also take the short form of the process name (ImageFileName), i.e the one in the EPROCESS structure.

https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/-processfields

Sadly, other than using LiveKd.exe to enumerate the list of processes, I'm not sure how you can get this value? Do you have any processes to exclude that are over 15 characters?

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel