Database and encrypted files should generally be excluded from scanning to avoid performance and functionality issues. The exclusions below should be considered depending on the type of machine you are installing the OfficeScan client on.
To exclude the following, you need to log on to the OfficeScan management console and go to Networked Computers > Client Management > Scan Settings > Real-time Scan Settings.
General Exclusion for all Windows platforms
[ Expand All ]
- *.pst
- %systemroot%\System32\Spool
- %systemroot%\SoftwareDistribution\Datastore
- %allusersprofile%\NTUser.pol
- %Systemroot%\system32\GroupPolicy\registry.pol
Note: The system variables are not recognized so replace "%systemroot%" and "%allusersprofile%" with actual directory.
Microsoft Active Directory Domain Controller
- DRIVE:\WINNT\SYSVOL
- DRIVE:\WINNT\NTDS
- DRIVE:\WINNT\ntfrs
- DRIVE:\WINNT\system32\dhcp
- DRIVE:\WINNT\system32\dns
Web Server log files should be excluded from scanning. By default, IIS logs are saved in:
- DRIVE:\WINNT\system32\LogFiles
- DRIVE:\WINNT\system32\IIS Temporary Compressed Files
Web Server log files should be excluded from scanning. By default, IIS logs are saved in:
The data directory is used to store Domino email messages. Repeated scanning of this folder while it is being updated with new messages is not an efficient way to scan locally-stored emails. Use virus scanning applications, like ScanMail for Domino to handle email viruses.
By default, the Domino data directory for a non-partitioned installation is: \Lotus\Domino\Data.
- Drive:\Program Files\Call Manager
- Drive:\Program Files\Call Manager Serviceability
- Drive:\Program Files\Call Manager Attendant
Because scanning may hinder performance, large databases should not be scanned. Since Microsoft SQL Server databases are dynamic, exclude the directory and backup folders from the scan list. If it is necessary to scan database files, a scheduled task can be created to scan them during off-peak hours.
- DRIVE:\Program Files\Microsoft SQL Server\MSSQL\Data
- DRIVE:\WINNT\Cluster (if using SQL Clustering)
- Q:\ (if using SQL Clustering)
- C:\Program Files\Microsoft SQL Server\MSSQL.X\OLAP\Data
- File extensions to exclude: .mdf, .ldf, .ndf, .bak, .tm
- Q:\ (Quorum drive)
- C:\Windows\Cluster
Microsoft Sharepoint Portal Server
- DRIVE:\Program Files\SharePoint Portal Server
- DRIVE:\Program Files\Common Files\Microsoft Shared\Web Storage System
- DRIVE:\Windows\Temp\Frontpagetempdir
- M:\
Microsoft SharePoint Servers Foundation 2010
- Drive:\Program Files\Common Files\Microsoft Shared\Web Server Extensions
- Drive:\Windows\Microsoft.NET\Framework64\v2.0.50727\Temporary ASP.NET Files
- Drive:\Users\ServiceAccount\AppData\Local\Temp
- Drive:\Users\Default\AppData\Local\Temp
- Drive:\Users\the account that the search service is running as\AppData\Local\Temp
- Drive:\WINDOWS\system32\LogFiles
- Drive:\Windows\Syswow64\LogFiles
Microsoft SharePoint Server 3.0 / 2007 / 2010
- Drive:\Program Files\Microsoft Office Servers
- Drive:\Program Files\Common Files\Microsoft Shared\Web Service Extensions
- Drive:\Windows\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files
- Drive:\Documents and Settings\All Users\Application Data\Microsoft\SharePoint\Config
- Drive:\Windows\Temp\WebTempDir
- Drive:\Documents and Settings\the account that the search service is running as\Local Settings\Temp\
- Drive:\WINDOWS\system32\LogFiles
Microsoft Systems Management Server (SMS)
- SMS\Inboxes\SMS_Executive Thread Name
- SMS_CCM\ServiceData
Microsoft Operations Manager Server (MOM)
- DRIVE:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Operations Manager
- DRIVE:\Program Files\Microsoft Operations Manager 2005
- Microsoft Internet Security and Acceleration Server (ISA)
- DRIVE:\Program Files\Microsoft ISA Server\ISALogs
- DRIVE:\Program Files\Microsoft SQL Server\MSSQL$MSFW\Data
Microsoft Windows System Update Server (WSUS)
Other file extension types that should be added to the exclusion list include large flat and designed files, such as VMWare disk partition. Scanning VMWare partitions while attempting to access them can affect session loading performance and the ability to interact with the virtual machine. Exclusions can be configured for the directory(ies) that contain the Virtual Machines, or by excluding *.vmdk and *.vmem files.
Microsoft Exchange Server
Exclude the directory or partition where MS Exchange stores its mailbox. Use virus scanning applications, like ScanMail for Exchange, to handle email viruses. Installable File System (IFS) drive must also be excluded to prevent the corruption of the Exchange Information Store.
- DRIVE:\EXCHSRVR\IMCData
- DRIVE:\EXCHSRVR\MDBData
- DRIVE:\EXCHSRVR\MDBData
- DRIVE:\EXCHSRVR\MTAData
- DRIVE:\EXCHSRVR\Mailroot
- DRIVE:\EXCHSRVR\SrsData
- DRIVE:\WINNT\system32\InetSrv
- DRIVE:\EXCHSRVR\MDBData
- DRIVE:\EXCHSRVR\MTAData
- DRIVE:\EXCHSRVR\Mailroot
- DRIVE:\EXCHSRVR\SrsData
- DRIVE:\WINNT\system32\InetSrv
- DRIVE:\EXCHSRVR\MdbDataUtility
Mapped Drives / Shared Folders
This option is best disabled. If it is enabled, it may create unnecessary network traffic when the end users access remote paths or mapped network drives. It can severely impact the user’s experience. Consider disabling this function if all workstations have OfficeScan client installed, and updated to the latest virus signature.
Backup process takes longer to finish when real-time scan is enabled. There are also instances when real-time scan detects an infected file in the volume shadow copy but cannot enforce the scan action because volume shadow copies have read-only access.
On Citrix systems following extensions have been causing performance problems. Exclude these file extensions to avoid any performance problems.
- *.LOG, *.DAT, *.TMP, *.POL, *.PF
- C:\Program Files\Novell\Zenworks
- Exclude the following files: NalView.exe, RMenf.exe, ZenNotifyIcon.exe, ZenUserDaemon.exe, casa.msi, dluenf.dll, fileInfo.db, lcredmgr.dll, objInfo.db
- Exclude the following extensions: .APPSTATE, .LOG, .TMP, .ZC
Other Trend Micro Products
Make sure that the check box for Exclude from scanning the directories where Trend Micro products are installed is enabled in the OfficeScan Exclusion List settings.
Connect with us on
| | | |