This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SEC 5.5.0 Folder exclusions not pushed out to Servers

Hi all,

I have setup various anti-virus on demand scanning folder exclusions for a Server Group. When I check the various Servers none of the excluded folders show up as excluded on the individual Servers.

I doubled checked this Server group to see which policy is applying to them and on that policy for "Anti-Virus and Hips" have selected to configure "On Access Scanning" and then selected the folder exclusions. None of these show up on the individual Servers.

Any ideas? I have watched the Sophos video www.youtube.com/watch how to exclude files and folders so I'm fairly sure I'm doing it correctly.I also rebooted the Servers in question but no joy as well as selecting "Comply with all group policies".

Thanks

This thread was automatically locked due to age.

0 Haridoss Sreenivasan over 7 years ago

Hi Brown-Bear

Please send a screenshot of the policy assigned to the Server group via DM so that I could check and guide you further.

Haridoss Sreenivasan
Technical Support Engineer | Sophos Technical Support
Knowledge Base | @SophosSupport | Video tutorials
Remember to like a post. If a post (on a question thread) solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 7 years ago

Hello Brown-Bear,

just to make sure, do the servers show Same as policy for Policy compliance?
I'm a little bit confused, first you say setup various anti-virus on demand scanning folder exclusions and later selected to configure "On Access Scanning" (emphases mine) - so where/how do you check the various Servers? Guess exclusions won't reveal any secrets so could you provide a screenshot of the exclusions in the policy and another one of the check on one of the servers?

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 Brown-Bear over 7 years ago in reply to Haridoss Sreenivasan

Just sent to support@sophos.com Haridoss
Cancel
Vote Up 0 Vote Down

Cancel
0 Haridoss Sreenivasan over 7 years ago in reply to Brown-Bear

Hi Brown-Bear

Please hover the mouse cursor on my name and send the screenshot via private message.

Haridoss Sreenivasan
Technical Support Engineer | Sophos Technical Support
Knowledge Base | @SophosSupport | Video tutorials
Remember to like a post. If a post (on a question thread) solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Brown-Bear over 7 years ago in reply to QC

Thanks Christian,

Sorry let me clarify. Under "Anti-virus and Hips" I have created a Server group with a number of Servers in it.

When I view edit this policy and select configure beside on-access scanning ...in windows exclusions I have added in a number of folder exclusions and files that I don't want scanned.

When I go to any of the Servers that the policy applies to they don't have the new exclusions I added even after a reboot. They show "Same as policy" with regard to compliance.
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 7 years ago in reply to Brown-Bear

Hello Brown-Bear,

policies are applied as soon as they are received, no reboot required. they don't have the new exclusions - you open the local GUI, Configure anti-virus and HIPS → On-access scanning → tab Exclusions?

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 Haridoss Sreenivasan over 7 years ago in reply to Brown-Bear

Hi Brown-Bear

Please share the configuration file(.xml) from one of the servers, from the following path:

<C:\ProgramData\Sophos\Sophos Anti-Virus\Config\machine.xml

Note: Please send the .xml file via DM

Haridoss Sreenivasan
Technical Support Engineer | Sophos Technical Support
Knowledge Base | @SophosSupport | Video tutorials
Remember to like a post. If a post (on a question thread) solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Brown-Bear over 7 years ago in reply to QC

Thanks Christian,Yes that's the way I am checking individual servers
Cancel
Vote Up 0 Vote Down

Cancel
0 Brown-Bear over 7 years ago in reply to Brown-Bear

That's assuming it should show in the local GUi of a Server?
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 7 years ago in reply to Brown-Bear

Hell Brown-Bear,

for anti-virus and HIPS the policy settings should show in the local GUI (but not necessarily with the same layout). In particular exclusions look like in the policy.

Christian
Cancel
Vote Up 0 Vote Down

Cancel