Real-Time Scan Exclusion Variable\WildCard Confirmation

Question

I want to exclude the following (example) from real-time scanning: 
 This directory ( 26e9f183-6e80-4436-8461-a67d55c5e4b1) is randomized within the user's profile temp directory 
 c:\Users	estuser\Temp\26e9f183-6e80-4436-8461-a67d55c5e4b1 
 These files are randomized within that directory. There is always a .tmp one, and numerous ones that start with testtemp_ then random after, no file ext. 
 testc8dea266-6496-46f7-9280-72ec449eb3f0.tmp testtemp_0MC9NCIDNG8578DMLROD0SSVQM23 
 I created these two exclusions, are they correct? 
 %temp%\*	est*.tmp %temp%\*	esttemp_*

Qoosh · Accepted Answer

I was able to test the exclusions on a VM and they do appear to be working as intended. I suggest checking the following registry key to verify that the exclusions have been applied to the local device. The exclusion will need to be entered as "Real-time and scheduled" - HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\EndpointDefense\PolicyConfiguration\ - OnDemandExcludedFilePaths 
 Let me know if you experience any issues.

Qoosh · Answer

"OnDemand" refers to a manually triggered scan, or scheduled scan on an endpoint. 
 If these are VDI devices, then a real-time scanning exclusion will work just fine as long as you have not configured any full system scans.

Real-Time Scan Exclusion Variable\WildCard Confirmation

Top Replies