SMS/ConfigMgr Anti-Virus exclusion considerations

In addition to Shaun’s posting here:

http://myitforum.com/cs2/blogs/scassells/archive/2007/05/14/what-anti-virus-scanning-exclusions-should-be-considered-for-system-and-servers.aspx

I wanted to post the additional information I’ve found for anti-virus exclusions… nothing pretty just a quick list of the information I’ve found.  This is merely a collection of information, not a best-practices guide.  Hopefully the information below will help you to develop the best setup for your environment.

-Chris

Systems Management Server (SMS) 2 & 2003 (dependent on SQL Server) http://support.microsoft.com/?id=327453 http://support.microsoft.com/?id=871161	-	install.map	C:\SMS	Prevents contention for install.map data file.
		*.adc, *.box, *.ccr, *.cfg, *.cmn, *.ct0, *.ct1, *.ct2, *.dat, *.dc, *.ddr, *.i*, *.ins, *.ist, *.job, *.lkp, *.lo_, *.log, *.mif, *.mof, *.nal, *.ncf, *.nhm, *.ofn, *.ofr, *.p*, *.pcf, *.pck, *.pdf, *.pkg, *.pkn, *.rpl, *.rpt, *.sca, *.scd, *.scu, *.sha, *.sic, *.sid, *.srq, *.srs, *.ssu, *.svf, *.tmp, *.udc	C:\SMS\Inboxes (exclude file types or all files for all sub folders under C:\SMS\Inboxes, with the exception of C:\SMS\Inboxes\clicomp.src and C:\SMS\Inboxes\colfile.box folders).	Site Server inboxes (only applies to servers providing Site Server services)
		*.log	C:\SMS\Logs	SMS Logs
		*.*	C:\SMS\Netmon\i386\captures C:\SMS\Netmon\i386\experts	Netmon capture and data files
		-	C:\SMS\CAP_%SMSSiteCode% (where %SMSSiteCode% is the three character site code in SMS) (exclude file types or all files for all sub folders under C:\SMS\Inboxes)	Client Access Point inboxes (CAP) inboxes (only applies to servers providing CAP services)
		*.* /s	C:\SMSPKG folder (this is typically the drive that contains the most available disk space)	Distribution manager stores compressed copy of package.
		*.tmp	C:\ (by default this is the same drive as the on that contains the above SMSPKG folder)	Distribution manager compresses temporary copy of package.
		*.msg *.que *.xml	C:\SMS_CCM\ServiceData	Management Point (MP) (only applies to SMS 2003 Management Points)
SMS 2003 Clients (running ITMU)	-	wsusscan.cab /s	%SystemRoot%\SoftwareDistribution\Scanfile	The Windows Update catalog is a big file and can cause performance issues when copied around on the client machine if AV is set to scan inside archived files. Because the Wsusscan.cab file contains several nested cabinet files, excluding the Wsusscan.cab file itself is not typically sufficient to combat the high CPU use unless you can also specify to exclude its contents.
			%SystemRoot%\system32\CCM\Cache	SMS client cache folder
			%SystemRoot%\system32\VPCache	Package ID folder for the inventory tool

And here is another list someone had put together:

SMS 2003 McAfee Settings

Low-Risk Processes

Processes

CCMEXEC.exe

SITECOMP.exe

SLPEXEC.exe

SMSDBMON.exe

SMSEXEC.exe

Scan Files

Scan on Data Read - NO

Scan on Data Write - NO

Exclusions

None

Default Processes

Processes

N/A

Scan Files

Scan on Data Read - YES

Scan on Data Write – NO

Exclusions

Files of Type:

BAK	EDB	MDF	TMP	MIF	SMS
CTL	JOB	NDF	TRN	NAL	TCF
DAT	LDF	PCK	LDF	NCF
DBF	LO_	PSD	CFG	OFR
DMP	LOG	SRS	CHG	PKG

File Paths

Path	Exclude Subfolders
*System32\WBEM	Yes
D:\SMS	Yes
D:\SMS_CCM	Yes
E:\CAP_ENT	Yes
E:\SMSBackup	Yes
E:\SMSPKG	Yes
Pagefile.sys
Windows file protection
*SMS_CCM\ServiceData*
* SMS\Logs*
*SMS\Inboxes*

** We need some exclusions for SQL ***

High-Risk Processes

Processes

N/A

Scan Files

Scan on Data Read - YES

Scan on Data Write – NO

Exclusions

Files of Type:

BAK	EDB	MDF	TMP	MIF	SMS
CTL	JOB	NDF	TRN	NAL	TCF
DAT	LDF	PCK	LDF	NCF
DBF	LO_	PSD	CFG	OFR
DMP	LOG	SRS	CHG	PKG

File Paths

Path	Exclude Subfolders
*System32\WBEM	Yes
D:\SMS	Yes
D:\SMS_CCM	Yes
E:\CAP_ENT	Yes
E:\SMSBackup	Yes
E:\SMSPKG	Yes
Pagefile.sys	Yes
Windows file protection	Yes
*SMS_CCM\ServiceData*	Yes
* SMS\Logs*	Yes
*SMS\Inboxes*	Yes

*** We need some exclusions for SQL ***