WINDOWS ANTIVIRUS

EXCLUSION
RECOMMENDATIONS

Brian Abstract
Helmick

Field file,
Engineer
- Microsoft
This document will provide a baseline forPremier
the proper
directory,
and
process antivirus exclusions to be applied to Windows servers and clients with
special attention to specific roles.

Servers, Clients, and Role Specific

Version
1.0
1.1

Revised By
Brian Helmick
Brian Helmick

Date
5/15/2013
8/1/2013

Comments
Original Draft
Added Lync
Exclusions

TABLE OF CONTENTS
Purpose and Use..................................................................................................................... 6
General Exclusions Applies to Windows Server 2008 R2, Windows Server 2008, Windows
Server 2003, Windows XP, Windows Vista, and Windows 7.....................................................6
Microsoft Forefront files....................................................................................................... 6
Windows Update or Automatic Update related files.............................................................6
Windows Security files......................................................................................................... 6
Group Policy related files..................................................................................................... 7
Domain Controllers - Windows Server 2008 R2, Windows Server 2008, Windows Server 2003
................................................................................................................................................ 7
Active Directory and Active Directory-related files...............................................................7
SYSVOL files......................................................................................................................... 7
DFS files............................................................................................................................... 9
DHCP files............................................................................................................................ 9
DNS files.............................................................................................................................. 9
WINS files............................................................................................................................ 9
Exchange 2003....................................................................................................................... 9
File and Directory Exclusions............................................................................................... 9
Process Exclusions............................................................................................................. 10
Exchange 2007..................................................................................................................... 10
File and Directory Exclusions.............................................................................................10
Mailbox server role......................................................................................................... 10
Process Exclusions............................................................................................................. 13
Additional Process Exclusions (If deploying ForeFront Security for Exchange Server)........14
File Name Extension Exclusions.........................................................................................14
Exchange 2010/2013............................................................................................................ 15
File and Directory Exclusions.............................................................................................15
Mailbox servers.............................................................................................................. 15
Client Access servers...................................................................................................... 16
Process Exclusions............................................................................................................. 17
File Name Extension Exclusions.........................................................................................17
Lync 2010.............................................................................................................................. 18
File and Directory Exclusions.............................................................................................18

Process Exclusions............................................................................................................. 18
Microsoft Cluster Servers...................................................................................................... 19
File and Directory Exclusions.............................................................................................19
Microsoft Hyper-V Servers, SCVMM........................................................................................19
File and Directory Exclusions.............................................................................................19
Process Exclusions............................................................................................................. 19
SQL Server............................................................................................................................ 19
Files and Directory Exclusions............................................................................................19
Process Exclusions............................................................................................................. 21
SQL Server 2012............................................................................................................ 21
SQL Server 2008 R2....................................................................................................... 21
SQL Server 2005............................................................................................................ 21
Configuration Manager 2007/2012........................................................................................21
File and Directory Exclusions.............................................................................................21
Process Exclusions............................................................................................................. 22
SCOM 2007/2012.................................................................................................................. 23
File and Directory Exclusions.............................................................................................23
SQL Database Servers.................................................................................................... 23
Operations Manager (Management Servers, Gateways and Agents)..............................23
Process exclusions............................................................................................................. 23
SharePoint............................................................................................................................. 23
SharePoint Foundation 2013.............................................................................................. 23
File and Directory Exclusions..........................................................................................23
SharePoint Server 2013..................................................................................................... 24
File and Directory Exclusions..........................................................................................24
SharePoint Foundation 2010.............................................................................................. 24
File and Directory Exclusions..........................................................................................24
SharePoint Server 2010..................................................................................................... 25
File and Directory Exclusions..........................................................................................25
Windows SharePoint Services 3.0......................................................................................26
File and Directory Exclusions..........................................................................................26
SharePoint Server 2007..................................................................................................... 27
File and Directory Exclusions..........................................................................................27
SharePoint Portal Server 2003...........................................................................................27
IIS Server............................................................................................................................... 27

Process Exclusions............................................................................................................. 28
WSUS.................................................................................................................................... 28
File and Directory Exclusions.............................................................................................28
CAB Files - Method 1.......................................................................................................... 28
CAB Files - Method 2.......................................................................................................... 28
App-V Clients......................................................................................................................... 29
File and Directory Exclusions.............................................................................................29
Windows Vista, Windows Server 2008 or later................................................................29
Windows XP or Windows Server 2003............................................................................29
Med-V.................................................................................................................................... 29
File and Directory Exclusions.............................................................................................29
DPM Server........................................................................................................................... 29
File and Directory Exclusions.............................................................................................29
Process Exclusions............................................................................................................. 30
ISA Server 2004/2006......................................................................................................... 30
Files and Directory Exclusions............................................................................................30
Process Exclusions............................................................................................................. 30
Forefront TMG - 2010............................................................................................................ 30
Files and Directory Exclusions............................................................................................30
Process Exclusions............................................................................................................. 31
Forefront UAG 2010............................................................................................................... 31
Files and Directory Exclusions............................................................................................31
Process Exclusions............................................................................................................. 32
Appendix A Sources............................................................................................................ 34
Prior Compilations.............................................................................................................. 34
General Exclusions............................................................................................................. 34
Domain Controllers............................................................................................................ 34
Exchange........................................................................................................................... 34
Lync................................................................................................................................... 34
Cluster Servers.................................................................................................................. 34
Hyper-V and SCVMM.......................................................................................................... 34
SQL.................................................................................................................................... 34
Configuration Manager...................................................................................................... 34
SCOM................................................................................................................................. 35
Sharepoint......................................................................................................................... 35

IIS...................................................................................................................................... 35
WSUS................................................................................................................................. 35
App-V Clients..................................................................................................................... 35
Med-V................................................................................................................................. 35
DPM................................................................................................................................... 35
ISA..................................................................................................................................... 35
Forefront TMG.................................................................................................................... 35
Forefront UAG.................................................................................................................... 35

PURPOSE AND USE

The information contained in this document is for the purpose of setting proper file,
directory, and process exclusions on Windows servers and clients. In addition to generic
exclusions which should be put in place across all servers and clients, role and application
specific exclusions are addressed as well. Specific files and processes are noted whenever
possible however, in their absence, it is implied to exclude the full directory path given. The
information contained within has been gathered from numerous published sources, many of
which are cited and can be accessed via the links included in the attached Appendix. This
guide is intended to be used as a baseline for establishing exclusion policies, however, it is
always recommended to follow up with specific product documentation and guidance in the
event any recommendations have been changed or added.
Keep in mind when using this document that these exclusion lists are cumulative.
For instance, when defining exclusions for an Exchange Server that is clustered,
the cumulative set of files, directories, and processes that should be excluded
would include those listed under General Exclusions, Exchange, Cluster, and in
some cases IIS.

GENERAL EXCLUSIONS APPLIES TO WINDOWS SERVER 2008 R2, WINDOWS

SERVER 2008, WINDOWS SERVER 2003, WINDOWS XP, WINDOWS VISTA,
AND WINDOWS 7
Important: When a directory that is to be excluded has a directory name greater than 8
characters long, add both the short and long directory names of the directory to the
exclusion list. These names are required by some AV programs to traverse the
subdirectories.
MICROSOFT FOREFRONT FILES

%windir%\SoftwareDistribution\Datastore
o
Tmp.edb
%ProgramData%\Microsoft\Search\Data\Applications\Windows
o
Log files

WINDOWS UPDATE OR AUTOMATIC UPDATE REL ATED FILES

%windir%\SoftwareDistribution\Datastore
o Datastore.edb
%windir%\SoftwareDistribution\Datastore\Logs
o Res*.log
o Edb*.jrs
o Edb.chk
o Tmp.edb

WINDOWS SECURITY FILES

%windir%\Security\Database
o *.edb
o *.sdb
o *.log

o
o

*.chk
*.jrs

GROUP POLICY REL ATED FILES

%allusersprofile%
o NTUser.pol
%Systemroot%\System32\GroupPolicy
o Registry.pol

Note: Do not exclude any one of these files based on the file name extension. For example,
do not exclude all files that have a .chk extension. Microsoft has no control over other files
that may use the same extensions as the files that are described above.
Note: All the files and folders that are noted above are protected by default permissions to
allow only SYSTEM and administrator access, and they contain only operating system
components. Excluding an entire folder may be simpler but may not provide as much
protection as excluding specific files based on file names.

DOMAIN CONTROLLERS - WINDOWS SERVER 2008 R2, WINDOWS SERVER

2008, WINDOWS SERVER 2003
ACTIVE DIRECTORY AND ACTIVE DIRECTORY-REL ATED FILES

NTDS database files - The location of these files is specified in the following registry
key:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\DSA
Database File. The default location is %windir%\Ntds.

o Ntds.dit
Active Directory transaction log files - The location of these files is specified in the
following registry key:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\Databas
e Log Files Path. The default location is %windir%\Ntds.
o EDB*.log
o Res*.log
o Edb*.jrs
o Ntds.pat
NTDS Working folder The location of this folder is specified in the following registry
key:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\DSA
Working Directory
o
o

Temp.edb
Edb.chk

SYSVOL FILES

File Replication Service (FRS) Working folder files The location of this folder is
specified in the following registry key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Working
Directory. The default location is %windir%\Ntfrs
o edb.chk in the %windir%\Ntfrs\jet\sys folder
o Ntfrs.jdb in the %windir%\Ntfrs\jet folder
o *.log in the %windir%\Ntfrs\jet\log folder
FRS Database Log files The location of this folder is specified in the following
registry key:
HKEY_LOCAL_MACHINE\System\Currentcontrolset\Services\Ntfrs\Parameters\DB Log
File Directory. The default location is %windir%\Ntfrs.
o Edb*.log (if the registry key is not set).
o FRS Working Dir\Jet\Log\Edb*.jrs (Windows Server 2008 and Windows Server
2008 R2).
Staging folder files The location of this folder is specified in the following registry
key.
o HKEY_LOCAL_MACHINE\System\Currentcontrolset\Services\NtFrs\Parameters\R
eplica Sets\GUID\Replica Set Stage. By default, staging uses the following
location: %systemroot%\Sysvol\Staging areas
Nntfrs_cmp*.*
Sysvol\Sysvol files - The current location of the Sysvol\Sysvol folder and all its
subfolders is the file system reparse target of the replica set root. The Sysvol\Sysvol
folder uses the following location: %systemroot%\Sysvol\Domain
o *.adm
o *.admx
o *.adml
o Registry.pol
o *.aas
o *.inf
o Fdeploy.inf
o Scripts.ini
o *.ins
o Oscfilter.ini
FRS Preinstall folder files Replica_root\DO_NOT_REMOVE_NtFrs_PreInstall_Directory
o Ntfrs*.*
DFSR database and working folder files - The location is specified by the following
registry key:
HKEY_LOCAL_MACHINE\System\Currentcontrolset\Services\DFSR\Parameters\Replicati
on Groups\GUID\Replica Set Configuration File=Path >. In this registry key, "Path" is
the path of an XML file that states the name of the Replication Group. In this
example, the path would contain "Domain System Volume." The default location is
the following hidden folder: %systemdrive%\System Volume Information\DFSR
o $db_normal$
o FileIDTable_*
o SimilarityTable_*
o *.xml
o $db_dirty$
o $db_lost$
o Dfsr.db
o Fsr.chk
o *.frx
o *.log
o Fsr*.jrs

Tmp.edb

If any one of these folders or files is moved or is put in a different location, scan or exclude
the equivalent element.
DFS FILES
The same resources that are excluded for a SYSVOL replica set must also be excluded when
FRS or DFSR is used to replicate shares that are mapped to the DFS root and link targets on
Windows Server 2008 R2-based, Windows Server 2008-based, Windows Server 2003-based,
or Windows 2000-based member computers or domain controllers.
DHCP FILES

The location of DHCP files is specified in the following registry key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DHCPServer\Parameters.
The DatabasePath, DhcpLogFilePath, and BackupDatabasePath parameters are the
paths to focus on. The default location for these files is %systemroot
%\System32\DHCP
o *.mdb
o *.pat
o *.log
o *.chk
o *.edb

DNS FILES

By default, DNS uses the following folder: %systemroot%\System32\Dns

o *.log
o *.dns
o BOOT

WINS FILES

By default, WINS uses the following folder: %systemroot%\System32\Wins

o *.chk
o *.log
o *.mdb

Note: Use a version of antivirus software that is designed to work with Active Directory
domain controllers and that uses the correct Application Programming Interfaces (APIs) to
access files on the server. Older versions of most vendor software inappropriately change a
file's metadata as the file is scanned. This causes the File Replication Service engine to
recognize a file change and therefore schedule the file for replication. Newer versions
prevent this problem.
Note: Do not put Active Directory or FRS database and log files on NTFS file system
compressed volumes.

EXCHANGE 2003
FILE AND DIRECTORY EXCLUSIONS

Exchange databases and log files across all storage groups. By default, these are
located in the Exchsrvr\Mdbdata folder.
Exchange MTA files in the Exchsrvr\Mtadata folder.
Additional log files such as the Exchsrvr\server_name.log directory.
The Exchsrvr\Mailroot virtual server folder.
The working folder that is used to store streaming .tmp files that are used for
message conversion. By default, this folder is Exchsrvr\Mdbdata, but the location is
configurable.
The Exchsrvr\Conndata folder.

Note: You may want to exclude the whole Exchsrvr folder from both on-demand file-level
scanners and memory-resident file-level scanners.

The temporary folder that is used in conjunction with offline maintenance utilities
such as Eseutil.exe. By default, this folder is the location where the .exe file is run
from, but you can configure where you run the file from when you run the utility.
Site Replication Service (SRS) files in the Exchsrvr\Srsdata folder.
Microsoft Internet Information Services (IIS) system files in the %SystemRoot
%\System32\Inetsrv folder.
Any messaging antivirus program folders.
Exclude the folder that contains the checkpoint (.chk) file

Note: Even if you move the Exchange databases and log files to new locations and exclude
those folders, the .chk file may still be scanned.
PROCESS EXCLUSIONS

Cdb.exe
Cidaemon.exe
Store.exe
Emsmta.exe
Mad.exe
Mssearch.exe
Inetinfo.exe
W3wp.exe

EXCHANGE 2007
FILE AND DIRECTORY EXCLUSIONS
MAILBOX SERVER ROLE

Mailbox Databases

Exchange databases, checkpoint files, and log files across all storage groups.
By default, these are located in sub-folders under the %Program Files
%\Microsoft\Exchange Server\Mailbox folder. You can obtain the directory
location by running the following commands in the Exchange Management
Shell:
To determine the location of a transaction log and checkpoint file, run the
following command: Get-StorageGroup -server <servername>| fl *path*
To determine the location of a mailbox database, run the following
command: Get-MailboxDatabase -server <servername>| fl *path*
To determine the location of a public folder database, run the following
command: Get-PublicFolderDatabase -server <servername>| fl *path*
o Database content indexes. By default, these are located in storage group subfolders under the %Program Files%\Microsoft\Exchange Server\Mailbox folder.
o General log files, such as message tracking log files. These files are located in
subfolders under the %Program Files%\Microsoft\Exchange
Server\TransportRoles\Logs folder and %Program Files%\Microsoft\Exchange
Server\Logging folder. To determine the log paths being used, run the
following command in the Exchange Management Shell: Get-MailboxServer
<servername>| fl *path*
o The Offline Address Book files that are located in subfolders under the
%Program Files%\Microsoft\Exchange Server\ExchangeOAB folder
o IIS system files in the %SystemRoot%\System32\Inetsrv folder
o The temporary folder that is used with offline maintenance utilities, such as
Eseutil.exe. By default, this folder is the location where the .exe file is run
from. However, you can configure where you perform the operation from when
you run the utility.
o The temporary folders that are used to perform conversions:
Content conversions are performed in the servers TMP folder.
OLE conversions are performed in %Program Files%\Microsoft\Exchange
Server\Working\OleConvertor folder.
The Mailbox database temporary folder: %Program Files
%\Microsoft\Exchange Server\Mailbox\MDBTEMP
o Any Exchange-aware antivirus program folders
Clustered Mailbox server (in addition to those listed above)
o The quorum disk and the %Winnt%\Cluster folder
o The file share witness. This is located on another server in the environment,
typically a Hub Transport server.
o The ExchangeOAB directory on a shared drive. The location is specified by the
registry key
SYSTEM\CurrentControlSet\Services\MSExchangeSA\Parameters\<CMSname>\OabDropFolderLocation
By default, the ExchangeOAB directory is at the following location:
%Program Files%\Microsoft\Exchange Server\ExchangeOAB
Hub Transport server role
o General log files, for example, message tracking. These files are located in
subfolders under the %Program Files%\Microsoft\Exchange
Server\TransportRoles\Logs folder. To determine the log paths being used, run
the following command in the Exchange Management Shell: GetTransportServer <servername>| fl *logpath*,*tracingpath*
o

o
Edge
o

The message folders that are located under the %Program Files
%\Microsoft\Exchange Server\TransportRoles folder. To determine the paths
being used, run the following command in the Exchange Management Shell:
Get-TransportServer <servername>| fl *dir*path*
The transport server role queue database, checkpoint, and log files that are
located in the %Program Files%\Microsoft\Exchange
Server\TransportRoles\Data\Queue folder.
The transport server role Sender Reputation database, checkpoint, and log
files that are located in the %Program Files%\Microsoft\Exchange
Server\TransportRoles\Data\SenderReputation folder
The transport server role IP filter database, checkpoint, and log files that are
located in the %Program Files%\Microsoft\Exchange
Server\TransportRoles\Data\IpFilter folder
The temporary folders that are used to perform conversions:
Content conversions are performed in the servers TMP folder.
OLE conversions are performed in %Program Files%\Microsoft\Exchange
Server\Working\OleConvertor folder.
Any Exchange-aware antivirus program folders
Transport server role
The Active Directory Application Mode (ADAM) database and log files that are
located in the %Program Files%\Microsoft\Exchange
Server\TransportRoles\Data\Adam folder. For more information about how to
obtain the directory location if the ADAM database files have been moved
from the default location, see How to Modify ADAM Configuration.
General log files, for example message tracking. These files are located in
subfolders under the %Program Files%\Microsoft\Exchange
Server\TransportRoles\Logs folder. To determine the log paths being used, run
the following command in the Exchange Management Shell: GetTransportServer <servername>| fl *logpath*,*tracingpath*
The message folders that are located under the %Program Files
%\Microsoft\Exchange Server\TransportRoles folder. To determine the log paths
being used, run the following command in the Exchange Management Shell:
Get-TransportServer <servername>| fl *dir*path*
The transport server role queue database, checkpoint, and log files that are
located in the %Program Files%\Microsoft\Exchange
Server\TransportRoles\Data\Queue folder. For more information about how to
obtain the directory location if the queue database files have been moved
from the default location, see Working with the Queue Database on Transport
Servers.
The transport server role Sender Reputation database, checkpoint, and log
files that are located in the %Program Files%\Microsoft\Exchange
Server\TransportRoles\Data\SenderReputation folder
The transport server role IP filter database, checkpoint, and log files that are
located in the %Program Files%\Microsoft\Exchange
Server\TransportRoles\Data\IpFilter folder
The temporary folders that are used to perform conversions:
Content conversions are performed in the servers TMP folder.
OLE conversions are performed in %Program Files%\Microsoft\Exchange
Server\Working\OleConvertor folder.

o Any Exchange-aware antivirus program folders

Client Access server role
o The Internet Information Services (IIS) 6.0 compression folder that is used with
Microsoft Outlook Web Access. By default, the compression folder in IIS 6.0 is
located at %systemroot%\IIS Temporary Compressed Files.
o IIS system files in the %SystemRoot%\System32\Inetsrv folder
o The Internet-related files that are stored in the sub-folders of the %Program
Files%\Microsoft\Exchange Server\ClientAccess folder
o The temporary folder that is used to perform content conversion. By default,
this is the servers TMP folder.
Unified Messaging server role
o The grammar files that are stored in the subfolders in the %Program Files
%\Microsoft\Exchange Server\UnifiedMessaging\grammars folder
o The voice prompts that are stored in the subfolders in the %Program Files
%\Microsoft\Exchange Server\UnifiedMessaging\Prompts folder
o The voicemail files that are stored in the %Program Files%\Microsoft\Exchange
Server\UnifiedMessaging\voicemail folder
o The bad voicemail files that are stored in the %Program Files
%\Microsoft\Exchange Server\UnifiedMessaging\badvoicemail folder
Microsoft ForeFront Security for Exchange Server
o The archived messages that are stored in the %Program Files%\Microsoft
ForeFront Security\Exchange Server\Data\Archive folder
o The quarantined files that are stored in the %Program Files%\Microsoft
ForeFront Security\Exchange Server\Data\Quarantine folder
o The antivirus engine files that are stored in the subfolders of %Program Files
%\Microsoft ForeFront Security\Exchange Server\Data\Engines\x86 folder
o The configuration files that are stored in the %Program Files%\Microsoft
ForeFront Security\Exchange Server\Data folder
Microsoft ForeFront Security For Exchange Server on Single Copy Clusters (SCC)
In addition to the directories that contain antivirus engine and configuration files,
exclude the directory on the shared storage used for ForeFront data.
To determine the path that ForeFront uses on an SCC, check the value of the following
registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Forefront Server
Security\Exchange Server\DatabasePath

PROCESS EXCLUSIONS
Cdb.exe

Cidaemon.exe

Cluster.exe

Dsamain.exe

Edgecredentialsvc.exe

Edgetransport.exe

Galgrammargenerator.exe

Inetinfo.exe

Mad.exe

Microsoft.Exchange.Antispamu
pdatesvc.exe

Microsoft.Exchange.Contentfilter
.Wrapper.exe

Microsoft.Exchange.Edgesyncsv
c.exe

Microsoft.Exchange.Imap4.exe

Microsoft.Exchange.Imap4servic
e.exe

Microsoft.Exchange.Infoworker.
Assistants.exe

Microsoft.Exchange.Monitoring
.exe

Microsoft.Exchange.Pop3.exe

Microsoft.Exchange.Pop3service
.exe

Microsoft.Exchange.Search.Ex
search.exe

Microsoft.Exchange.Servicehost.
exe

Msexchangeadtopologyservice.
exe

Msexchangefds.exe

Msexchangemailboxassistants.e
xe

Msexchangemailsubmission.exe

Msexchangetransport.exe

Msexchangetransportlogsearch.
exe

Msftefd.exe

Msftesql.exe

Oleconverter.exe

Powershell.exe

Sesworker.exe

Speechservice.exe

Store.exe

Transcodingservice.exe

Umservice.exe

Umworkerprocess.exe

W3wp.exe

ADDITIONAL PROCESS EXCLUSIONS (IF DEPLOYING FOREFRONT SECURITY FOR

EXCHANGE SERVER)
Adonavsvc.exe

Fsccontroller.exe

Fscdiag.exe

Fscexec.exe

Fscimc.exe

Fscmanualscanner.exe

Fscmonitor.exe

Fscrealtimescanner.exe

Fscstarter.exe

Fscstatsserv.exe

Fsctransportscanner.exe

Fscutility.exe

Fsemailpickup.exe

Fssaclient.exe

Getenginefiles.exe

Perfmonitorsetup.exe

Scanenginetest.exe

Semsetup.exe

FILE NAME EXTENSION EXCLUSIONS

Application-related extensions
o *.config
o *.dia
o *.wsb
Database-related extensions
o *.chk
o *.log
o *.edb
o *.jrs
o *.que
Offline Address Book-related extensions:
o *.lzx
Content Index-related extensions
o *.ci
o *.dir
o *.wid
o *.000
o *.001
o *.002
Unified Messaging-related extensions
o *.cfg
o *.grxml
ForeFront Security for Exchange Serverrelated extensions

o
o
o
o
o
o
o
o
o
o
o
o
o
o
o
o
o
o
o
o
o

*.avc
*.cab
*.cfg
*.config
*.da1
*.dat
*.def
*.dt
*.fdb
*.fdm
*.ide
*.key
*.klb
*.kli
*.lst
*.mdb
*.ppl
*.set
*.v3d
*.vdb
*.vdm

EXCHANGE 2010/2013
You must exclude specific directories for each Exchange server on which you run a file-level
antivirus scanner. This section describes the directories that you should exclude from filelevel scanning.
FILE AND DIRECTORY EXCLUSIONS
MAILBOX SERVERS

Mailbox Databases
o Exchange databases, checkpoint files, and log files. By default, these are
located in sub-folders under the %ExchangeInstallPath%Mailbox folder. To
determine the location of a mailbox database, transaction log, and checkpoint
file, run the following command: Get-MailboxDatabase -Server <servername>|
Format-List *path*
o Database content indexes. By default, these are located in the same folder as
the database file.
o Group Metrics files. By default, these files are located in the
%ExchangeInstallPath%GroupMetrics folder.
o General log files, such as message tracking and calendar repair log files. By
default, these files are located in subfolders under the %ExchangeInstallPath
%TransportRoles\Logs folder and %ExchangeInstallPath%Logging folder. To
determine the log paths being used, run the following command in the
Exchange Management Shell: Get-MailboxServer <servername> | Format-List
*path*

The Offline Address Book files. By default, these are located in subfolders
under the %ExchangeInstallPath%ClientAccess\OAB folder.
o IIS system files in the %SystemRoot%\System32\Inetsrv folder.
o The Mailbox database temporary folder: %ExchangeInstallPath
%Mailbox\MDBTEMP
Members of Database Availability Groups
o All the items listed in the Mailbox databases list, and the cluster quorum
database that exists at %Windir%\Cluster.
o The witness directory files. These files are located on another server in the
environment, typically a Client Access server that isnt installed on the same
computer as a Mailbox server. By default, the witness directory files are
located in %SystemDrive%:\DAGFileShareWitnesses\<DAGFQDN>.
Transport service
o Log files, for example, message tracking and connectivity logs. By default,
these files are located in subfolders under the %ExchangeInstallPath
%TransportRoles\Logs folder. To determine the log paths being used, run the
following command in the Exchange Management Shell: Get-TransportService
<servername> | Format-List *logpath*,*tracingpath*
o Pickup and Replay message directory folders. By default, these folders are
located under the %ExchangeInstallPath%TransportRoles folder. To determine
the paths being used, run the following command in the Exchange
Management Shell: Get-TransportService <servername>| fl *dir*path*
o The queue databases, checkpoints, and log files. By default, these are located
in the %ExchangeInstallPath%TransportRoles\Data\Queue folder.
o The Sender Reputation database, checkpoint, and log files. By default, these
are located in the %ExchangeInstallPath
%TransportRoles\Data\SenderReputation folder.
o The temporary folders that are used to perform conversions:
By default, content conversions are performed in the Exchange servers
%TMP% folder.
By default, OLE conversions are performed in %ExchangeInstallPath
%Working\OleConverter folder.
o The content scanning component is used by the Malware agent and data loss
prevention (DLP). By default, these files are located in the
%ExchangeInstallPath%FIP-FS folder.
Mailbox Transport service
o Log files, for example, connectivity logs. By default, these files are located in
subfolders under the %ExchangeInstallPath%TransportRoles\Logs\Mailbox
folder. To determine the log paths being used, run the following command in
the Exchange Management Shell: Get-MailboxTransportService <servername>
| Format-List *logpath*
Unified Messaging
o The grammar files for different locales, for example en-EN or es-ES. By
default, these are stored in the subfolders in the %ExchangeInstallPath
%UnifiedMessaging\grammars folder.
o The voice prompts, greetings and informational message files. By default,
these are stored in the subfolders in the %ExchangeInstallPath
%UnifiedMessaging\Prompts folder
o The voicemail files that are temporarily stored in the %ExchangeInstallPath
%UnifiedMessaging\voicemail folder.
o

The temporary files generated by Unified Messaging. By default, these are

stored in the %ExchangeInstallPath%UnifiedMessaging\temp folder.

CLIENT ACCESS SERVERS

Web components
o For servers using Internet Information Services (IIS) 7.0, the compression
folder that is used with Microsoft Outlook Web App. By default, the
compression folder for IIS 7.0 is located at %SystemDrive%\inetpub\temp\IIS
Temporary Compressed Files.
o IIS system files in the %SystemRoot%\System32\Inetsrv folder
o Inetpub\logs\logfiles\w3svc
POP3 and IMAP4 protocol logging
o POP3 folder: %ExchangeInstallPath%Logging\POP3
o IMAP4 folder: %ExchangeInstallPath%Logging\IMAP4
Front End Transport service
o Log files, for example, connectivity logs and protocol logs. By default, these
files are located in subfolders under the %ExchangeInstallPath
%TransportRoles\Logs\FrontEnd folder. To determine the log paths being used,
run the following command in the Exchange Management Shell: GetFrontEndTransportService <servername> | Format-List *logpath*

PROCESS EXCLUSIONS
Cdb.exe

Cidaemon.exe

Clussvc.exe

Dsamain.exe

EdgeCredentialSvc.exe

EdgeTransport.exe

ExFBA.exe

Inetinfo.exe

MSExchangeSubmission.exe

MSExchangeTransport.exe

MSExchangeTransportLogSearch.
exe

MSExchangeThrottling.exe

Msftefd.exe

Msftesql.exe

OleConverter.exe

Powershell.exe

ScanEngineTest.exe

ScanningProcess.exe

TranscodingService.exe

UmService.exe

Microsoft.Exchange.Pop3ser
vice.exe

Microsoft.Exchange.ProtectedSer
viceHost.exe

Microsoft.Exchange.RPCClientAcc
ess.Service.exe

Microsoft.Exchange.Search.S
ervice.exe

Microsoft.Exchange..Servicehost.
exe

Microsoft.Exchange.Store.Service
.exe

Microsoft.Exchange.Store.W
orker.exe

Microsoft.Exchange.TransportSyn
cManagerSvc.exe

Microsoft.Exchange.AntispamUpd
ateSvc.exe

Microsoft.Exchange.UM.Call
Router.exe

Microsoft.Exchange.ContentFilter.
Wrapper.exe

MSExchangeDelivery.exe

Microsoft.Exchange.Diagnos
tics.Service.exe

MSExchangeFrontendTransport.e
xe

Microsoft.Exchange.Directory.Top
ologyService.exe

MSExchangeHMHost.exe

Microsoft.Exchange.EdgeSyncSvc
.exe

MSExchangeHMWorker.exe

Microsoft.Exchange.Imap4.e
xe

Microsoft.Exchange.Imap4service
.exe

Microsoft.Exchange.Monitoring.e
xe

Microsoft.Exchange.Pop3.ex
e

MSExchangeLESearchWorker.exe

MSExchangeMailboxAssistants.ex

MSExchangeMailboxReplicat

MSExchangeRepl.exe

ion.exe

UmWorkerProcess.exe

UpdateService.exe

W3wp.exe

FILE NAME EXTENSION EXCLUSIONS

Application-related extensions:
o *.config
o *.dia
o *.wsb
Database-related extensions:
o *.chk
o *.edb
o *.jrs
o *.jsl
o *.log
o *.que
Offline address book-related extensions:
o *.lzx
Content Index-related extensions:
o *.ci
o *.dir
o *.wid
o *.000
o *.001
o *.002
Unified Messaging-related extensions:
o *.cfg
o *.grxml
Group Metrics-related extensions:
o *.dsc
o *.txt

LYNC 2010
FILE AND DIRECTORY EXCLUSIONS
Folder and file locations listed below are the default locations for Lync Server 2010. For any
locations for which you did not use the default, exclude the locations you specified for your
organization instead of the default locations specified in this topic.

%systemroot%\System32\LogFiles

%systemroot%\SysWow64\LogFiles

%systemroot%\Windows\Assembly\GAC_MSIL

%programfiles%\Microsoft Lync Server 2010

%programfiles%\commonfiles\Microsoft Lync Server 2010

%SystemDrive%\RtcReplicaRoot

File share store (specified in Topology Builder). File stores are specified in Topology
Builder.

SQL Server data and log files, including those for the back-end database, user store,
archiving store, monitoring store, and application store. Database and log files can be
specified in Topology Builder.

PROCESS EXCLUSIONS
ASMCUSvc.ex
e

DataProxy.exe

MasterReplicatorAgen
t.exe

MeetingMCUSvc.e
xe

QmsSvc.exe

AVMCUSvc.ex
e

FileTransferAgent
.exe

MediaRelaySvc.exe

MRASSvc.exe

ReplicaReplicatorAge
nt.exe

DataMCUSvc.
exe

IMMCUSvc.exe

MediationServerSvc.e
xe

OcsAppServerHos
t.exe

RTCArch.exe

RtcCdr.exe

RTCSrv.exe

MICROSOFT CLUSTER SERVERS

FILE AND DIRECTORY EXCLUSIONS

Quorum Drive (for instance Q:)

C:\Windows\Cluster
The path of the \mscs folder on the quorum hard disk. For example, exclude the
Q:\mscs folder from virus scanning.
The temp folder for the Cluster Service account. For example, exclude the
\clusterserviceaccount\Local Settings\Temp folder from virus scanning.

Note: The temp folder exclusion does not apply to clusters on Server 2008 or above as a
specific service account is no longer used.

MICROSOFT HYPER-V SERVERS, SCVMM

FILE AND DIRECTORY EXCLUSIONS

Default virtual machine configuration directory

o
C:\ProgramData\Microsoft\Windows\Hyper-V
Custom virtual machine configuration directories
Default virtual hard disk drive directory
o
C:\Users\Public\Documents\Hyper-V\Virtual Hard Disks

Custom virtual hard disk drive directories

Custom replication data directories, if you are using Hyper-V Replica
Snapshot directories
C:\Clusterstorage and all subdirectories (if using Live Migration together with Cluster
Shared Volumes)
All VHD, VHDX, AVHD, VSV and ISO files
o
*.vhd
o
*.vhdx
o
*.avhd
o
*.vsv
o
*.iso

PROCESS EXCLUSIONS

Vmms.exe
Vmwp.exe

SQL SERVER
FILES AND DIRECTORY EXCLUSIONS

SQL Server data files

o *.mdf
o *.ldf
o *.ndf
SQL Server backup files
o *.bak
o *.trn
Full-Text catalog files
o Default instance: Program Files\Microsoft SQL Server\MSSQL\FTDATA
o Named instance: Program Files\Microsoft SQL
Server\MSSQL$instancename\FTDATA
Trace files
o *.trc - these files can be generated either when you configure profiler tracing
manually or when you enable C2 auditing for the server.
SQL audit files (for SQL Server 2008 or later versions)
o *.sqlaudit
SQL query files
o *.sql
The directory that holds Analysis Services data default is C:\Program Files\Microsoft
SQL Server\MSSQL.X\OLAP\Data. You can view and change the data directory by
using Analysis Manager. To do this, follow these steps:
1.
In Analysis Manager, right-click the server, and then click Properties.
2.
In the Properties dialog box, click the General tab. The directory appears
under Data folder.
The directory that holds Analysis Services temporary files that are used during
Analysis Services processing default is C:\Program Files\Microsoft SQL
Server\MSSQL.X\OLAP\Data. You can view and change the directory that holds
temporary files in Analysis Manager. To do this, follow these steps:
1.
In Analysis Manager, right-click the server, and then click Properties.
2.
In the Properties dialog box, click the General tab.

3.

On the General tab, notice the directory under Temporary file folder.

Note : Optionally, you can add a second temporary directory for Analysis Services 2000 by
using the TempDirectory2 registry entry. If you use this registry entry, consider excluding
from virus scanning the directory to which this registry entry points

Analysis Services backup files default is C:\Program Files\Microsoft SQL

Server\MSSQL.X\OLAP\Backup
The directory that holds Analysis Services log files default is C:\Program
Files\Microsoft SQL Server\MSSQL.X\OLAP\Log
Directories for any Analysis Services 2005 and later-version partitions that are not
stored in the default data directory
Note When you create the partitions, these locations are defined in the Storage
location section of the Processing and Storage Locations page of the Partition Wizard.
Filestream data files (SQL 2008 and later versions)
Remote Blob Storage files (SQL 2008 and later versions)
The directory that holds Reporting Services temporary files and Logs (RSTempFiles
and LogFiles)

PROCESS EXCLUSIONS
SQL SERVER 2012

%ProgramFiles%\Microsoft SQL Server\MSSQL11.<Instance

Name>\MSSQL\Binn\SQLServr.exe
%ProgramFiles%\Microsoft SQL Server\MSRS11.<Instance Name>\Reporting
Services\ReportServer\Bin\ReportingServicesService.exe
%ProgramFiles%\Microsoft SQL Server\MSAS11.<Instance
Name>\OLAP\Bin\MSMDSrv.exe

SQL SERVER 2008 R2

%ProgramFiles%\Microsoft SQL Server\MSSQL10_50.<Instance

Name>\MSSQL\Binn\SQLServr.exe
%ProgramFiles%\Microsoft SQL Server\MSSQL10_50.<Instance Name>\Reporting
Services\ReportServer\Bin\ReportingServicesService.exe
%ProgramFiles%\Microsoft SQL Server\MSSQL10_50.<Instance
Name>\OLAP\Bin\MSMDSrv.exe
SQL Server 2008
%ProgramFiles%\Microsoft SQL Server\MSSQL10.<Instance
Name>\MSSQL\Binn\SQLServr.exe
%ProgramFiles%\Microsoft SQL Server\MSSQL10.<Instance Name>\Reporting
Services\ReportServer\Bin\ReportingServicesService.exe
%ProgramFiles%\Microsoft SQL Server\MSSQL10.<Instance
Name>\OLAP\Bin\MSMDSrv.exe

SQL SERVER 2005

%ProgramFiles%\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\SQLServr.exe

%ProgramFiles%\Microsoft SQL Server\MSSQL.3\Reporting
Services\ReportServer\Bin\ReportingServicesService.exe
%ProgramFiles%\Microsoft SQL Server\MSSQL.2\OLAP\Bin\MSMDSrv.exe

CONFIGURATION MANAGER 2007/2012

FILE AND DIRECTORY EXCLUSIONS

Drive:\<Config Mgr Install Folder>\Inboxes\SMS_Executive Thread Name

Drive:\SMS_CCM\ServiceData

Note: If you exclude the <DriveLetter):\<ConfigMgr install folder>\Inboxes directory from

virus scanning or remove the antivirus software, you may make the site server and all
clients vulnerable to potential virus risks. The client base component files reside in the
<DriveLetter):\<ConfigMgr install folder>\Inboxes directory, therefore use these options only
as a short-term troubleshooting step.
The following exclusions assume the ConfigMgrInstallDir is located at Drive:\Program
Files\Microsoft Configuration Manager

ConfigMgrInstallDir
o Install.map
ConfigMgrInstallDir\Inboxes

*.adc

*.dc

*.mif

*.pck

*.sha

*.box

*.ddr

*.mof

*.pdf

*.sic

*.ccr

*.i*

*.nal

*.pkg

*.sid

*.cfg

*.ins

*.ncf

*.pkn

*.srq

*.cmn

*.ist

*.nhm

*.rpl

*srs

*.ct0

*.job

*.ofn

*.rpt

*.ssu

*.ct1

*.lkp

*.ofr

*.sca

*.svf

*.ct2

*.lo_

*.p*

*.scd

*.tmp

*.dat

*.log

*.pcf

*.scu

*.udc

ConfigMgrInstallDir\Logs
o *.log
Drive:\SMSPKG
Drive:\SMSPKG?$ ($=driveletter)
Drive:\SMSPKGSIG
Drive:\SMSSIG$
Drive:\SCCMContentLib
Drive:\Program Files\SMS_CCM\ServiceData
o *.msg
o *.que

o *.xml
Drive:\Program Files\SMS_CCM\Logs
o *.log
Boot Image Folders - Temporary folder for these cases is
C:\Windows\TEMP\BootImages\{GUID}
o Exclude C:\Windows\TEMP\BootImages and subfolders.
Offline Servicing
o Temporary folder for offline servicing is
DRIVE:\ConfigMgr_OfflineImageServicing
and several subfolders used for different purposes staging files, mounting
OS, etc. where DRIVE: is the StagingDrive value from the Offline Servicing
Manager section of the site control file. If this value is missing, we use the
drive where the site is installed. Exclude
DRIVE:\ConfigMgr_OfflineImageServicing and subfolders.\

Note: For the configuration manager clients the following exclusion can be added:

%windir%ccmcache

PROCESS EXCLUSIONS

Smsexec.exe
Ccmexec.exe
CmRcService.exe
Sitecomp.exe
Smswriter.exe
Smssqlbbkup.exe

SCOM 2007/2012
FILE AND DIRECTORY EXCLUSIONS
The following file name extension-specific exclusions for Operations Manager includes realtime scans, scheduled scans, and local scans.
SQL DATABASE SERVERS
These exclusions include the SQL Server database files that are used by Operations Manager
components and the system database files for the master database and for the tempdb
database.
For example:

*.mdf
*.ldf

OPERATIONS MANAGER (MANAGEMENT SERVERS, GATEWAYS AND AGENTS)

These exclusions include the queue and log files that are used by Operations Manager.
For Example:

*.edb
*.chk
*.log

Note: Page files should also be excluded from any real-time scans.
PROCESS EXCLUSIONS

Monitoringhost.exe

SHAREPOINT
SHAREPOINT FOUNDATION 2013
FILE AND DIRECTORY EXCLUSIONS

Drive:\Program Files\Common Files\Microsoft Shared\Web Server Extensions

If you do not want to exclude the whole Web Server Extensions folder from antivirus
scanning, you can exclude only the following two folders:

Drive:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\Logs

Drive:\Program Files\Common Files\Microsoft Shared\Web Server
Extensions\15\Data\Applications

Note: The Applications folder must be excluded only if the computer is running the
SharePoint Foundation Search service. If the folder that contains the index file is located
elsewhere, you must also exclude that folder.

Drive:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files

Drive: \Users\ServiceAccount\AppData\Local\Temp\WebTempDir

Note: The WebTempDir folder is a replacement for the FrontPageTempDir folder.

Drive:\ProgramData\Microsoft\SharePoint
Drive:\Users\account that the search service is running as\AppData\Local\Temp

Note: The search account creates a folder in the Gthrsvc_spsearch4 Temp folder to which it
periodically has to write.

Drive:\WINDOWS\System32\LogFiles
Drive:\Windows\Syswow64\LogFiles

Note: If you use a specific account for SharePoint services or application pools identities,
you may also have to exclude the following folders:

Drive:\Users\ServiceAccount\AppData\Local\Temp
Drive:\Users\Default\AppData\Local\Temp

SHAREPOINT SERVER 2013

FILE AND DIRECTORY EXCLUSIONS

Drive:\Program Files\Microsoft Office Servers

Note: If you do not want to exclude the whole Microsoft Office Servers folder from antivirus
scanning, you can exclude only the following folders:

Drive:\Program Files\Microsoft Office Servers\15.0\Data

Note: This folder is used for the indexing process. If the index files are configured to be
located in a different folder, you also have to exclude that location.

Drive:\Program Files\Microsoft Office Servers\15.0\Logs

Drive:\Program Files\Microsoft Office Servers\15.0\Bin
Drive:\Program Files\Microsoft Office Servers\15.0\Synchronization Service
Any location in which you decided to store the disk-based binary large object (BLOB)
cache (for example, C:\Blobcache).

Note: If you have SharePoint Server 2013, these folders should be excluded in addition to
the folders that are listed in the "SharePoint Foundation 2013" section.
SHAREPOINT FOUNDATION 2010
FILE AND DIRECTORY EXCLUSIONS

Drive:\Program Files\Common Files\Microsoft Shared\Web Server Extensions

Note: If you do not want to exclude the whole Web Server Extensions folder from antivirus
scanning, you can exclude only the following two folders:

Drive:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\Logs

Drive:\Program Files\Common Files\Microsoft Shared\Web Server
Extensions\14\Data\Applications

Note: The Applications folder must be excluded only if the computer is running the
SharePoint Foundation Search service. If the folder that contains the index file is located
elsewhere, you must also exclude that folder.

Drive:\Windows\Microsoft.NET\Framework64\v2.0.50727\Temporary ASP.NET Files

Drive: \Users\ServiceAccount\AppData\Local\Temp\WebTempDir

Note: The WebTempDir folder is a replacement for the FrontPageTempDir folder.

Drive:\ProgramData\Microsoft\SharePoint
Drive:\Users\account that the search service is running as\AppData\Local\Temp

Note: The search account creates a folder in the Gthrsvc_spsearch4 Temp folder to which it
periodically has to write.

Drive:\WINDOWS\system32\LogFiles
Drive:\Windows\Syswow64\LogFiles

Note: If you use a specific account for SharePoint services or application pools identities,
you may also have to exclude the following folders:

Drive:\Users\ServiceAccount\AppData\Local\Temp
Drive:\Users\Default\AppData\Local\Temp

SHAREPOINT SERVER 2010

FILE AND DIRECTORY EXCLUSIONS

Drive:\Program Files\Microsoft Office Servers

Note: If you do not want to exclude the whole Microsoft Office Servers folder from antivirus
scanning, you can exclude only the following folders:

Drive:\Program Files\Microsoft Office Servers\14.0\Data

Note: This folder is used for the indexing process. If the Index files are configured to be
located in a different folder, you also have to exclude that location.

Drive:\Program Files\Microsoft Office Servers\14.0\Logs

Drive:\Program Files\Microsoft Office Servers\14.0\Bin
Drive:\Program Files\Microsoft Office Servers\14.0\Synchronization Service
Any location in which you decided to store the disk-based binary large object (BLOB)
cache (for example, C:\Blobcache)

Note: If you have SharePoint Server 2010, these folders should be excluded in addition to
the folders that are listed in the "SharePoint Foundation 2010" section.
WINDOWS SHAREPOINT SERVICES 3.0
FILE AND DIRECTORY EXCLUSIONS

Drive:\Program Files\Common Files\Microsoft Shared\Web Server Extensions

Note: If you do not want to exclude the whole Web Server Extensions folder from antivirus
scanning, you can exclude only the following two folders:

Drive:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\Logs

Drive:\Program Files\Common Files\Microsoft Shared\Web Server
Extensions\12\Data\Applications

Note: The Applications folder must be excluded only if the computer is running the Windows
SharePoint Services Search service. If the folder that contains the index file is located
elsewhere, you must also exclude that folder.

Drive:\Windows\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files

Note: If you are running a 64-bit version of Windows, you should also include the following
directory:

Drive:\Windows\Microsoft.NET\Framework64\v2.0.50727\Temporary ASP.NET Files

Drive:\Documents and Settings\All Users\Application Data\Microsoft\SharePoint\Config

Drive:\Windows\Temp\WebTempDir

Note: The WebTempDir folder is a replacement for the FrontPageTempDir folder.

Drive:\Documents and Settings\account that the search service is running as\Local

Settings\Temp\
Drive:\Users\the account the search service is running as\Local\Temp\

Note: The search account creates a folder in the "gthrsvc Temp" folder to which it
periodically has to write.

Drive:\WINDOWS\system32\LogFiles
Drive:\Windows\Syswow64\LogFiles

Note: If you use a specific account for SharePoint services or application pools identities,
you may also have to exclude the following folders:

Drive:\Documents and Settings\ServiceAccount\Local Settings\Application Data

Drive:\Users\ServiceAccount\Local
Drive:\Documents and Settings\ServiceAccount\Local Settings\Temp
Drive:\Users\ServiceAccount\Local\Temp
Drive:\Documents and Settings\Default User\Local Settings\Temp
Drive:\Users\Default\AppData\Local\Temp

SHAREPOINT SERVER 2007

FILE AND DIRECTORY EXCLUSIONS

Drive:\Program Files\Microsoft Office Servers

Note: If you do not want to exclude the whole Microsoft Office Servers folder from antivirus
scanning, you can exclude only the following folders:

Drive:\Program Files\Microsoft Office Servers\12.0\Data.

Note: This folder is used for the indexing process. If the index files are configured to be
located in a different folder, you also have to exclude that location.

Drive:\Program Files\Microsoft Office Servers\12.0\Logs

Drive:\Program Files\Microsoft Office Servers\12.0\Bin
Any location in which you decide to store the disk-based binary large object (BLOB)
cache (for example, C:\Blobcache)

Note: If you have SharePoint Server 2007, these folders should be excluded in addition to
the folders that are listed in the "Windows SharePoint Services 3.0" section.
Note: When you install SharePoint Server 2007 or apply a hotfix to an existing installation of
SharePoint Server 2007, you may have to disable the real-time option of the antivirus

software. Or, you may have to exclude the Drive:\Windows\Temp folder from antivirus
scanning if this is required.
SHAREPOINT PORTAL SERVER 2003

Drive:\Program Files\SharePoint Portal Server

Drive:\Program Files\Common Files\Microsoft Shared\Web Storage System

Note: Drive: is the drive letter where you installed SharePoint Portal Server.

If drive M is mounted, you must exclude this drive from the scan.
If any data was placed in another location throughout the installation process you
must exclude that location also.
If you are using Microsoft SharePoint Portal Server 2003 and you apply Service Pack 1
(SP1), you must exclude the following folder from Anti Virus scans:
o
Drive:\Windows\Temp\Frontpagetempdir

IIS SERVER
Exclude the IIS compression directory from the antivirus software's scan list.
The default compression directory in IIS 6.0 is %systemroot%\IIS Temporary Compressed
Files. This directory may have been changed to another location. In IIS 7.0, the default
location of the compressed file cache is %SystemDrive%\inetpub\temp\IIS Temporary
Compressed Files.
To verify the compression directory:
1.

Click Start, point to Programs, point to Administrative Tools, and then click Internet
Information Services (IIS) Manager.
In IIS Manager, right-click the Web Sites folder, and then click Properties.
Click the Service tab.

2.
3.

Under HTTP Compression, make sure that Compress static files is selected, and then locate
the path to the temporary directory.
PROCESS EXCLUSIONS

%systemroot%\system32\inetsrv\w3wp.exe
%systemroot%\SysWOW64\inetsrv\w3wp.exe

WSUS
FILE AND DIRECTORY EXCLUSIONS

\WSUS\WSUSContent
\WSUS\UpdateServicesDBFiles
\SoftwareDistribution\Datastore
\SoftwareDistribution\Download

CAB FILES - METHOD 1

Wsusscan.cab file and the Wsusscn2.cab file

Note: Because the Wsusscan.cab file and the Wsusscn2.cab file contain several nested
cabinet files, excluding only these files is not typically sufficient to reduce unusually high
CPU usage. To significantly reduce CPU usage, also exclude nested cabinet files that are
within the Wsusscan.cab file and the Wsusscn2.cab file.
Note: If a virus is present in a .cab file, the virus should be detected when the file is
uncompressed. Therefore, there is almost no increased risk in using this method.
CAB FILES - METHOD 2

Exclude all .cab files from the antivirus scan.

Note: If a virus is present in a .cab file, the virus should be detected when the file is
uncompressed. Therefore, there is almost no increased risk in using this method.

APP-V CLIENTS
FILE AND DIRECTORY EXCLUSIONS
WINDOWS VISTA, WINDOWS SERVER 2008 OR LATER

%USERPROFILE%\AppData\Local\SoftGrid Client
%USERPROFILE%\AppData\Roaming\SoftGrid Client
%PROGRAMDATA%\Microsoft\Application Virtualization Client\SoftGrid Client

WINDOWS XP OR WINDOWS SERVER 2003

%USERPROFILE%\Application Data\SoftGrid Client

%ALLUSERSPROFILE%\Application Data\Microsoft\Application Virtualization Client\
%ALLUSERSPROFILE%\Documents\SoftGrid Client

MED-V
FILE AND DIRECTORY EXCLUSIONS

Virtual Hard Disk Image files

o

*.vhd

Virtual PC Undo Disk Files

o

Virtual PC saved state files

o

*.vmc

Index files used by TrimTransfer feature

o

*.ckm

Base virtual machine settings files

o

*.vsv

Packed image format used by MED-V (Kidaro Compressed Machine.) These will be
present on MED-V Servers, Image Distribution Servers, locally packed images on
MED-V Administration workstations, and as pre-staged images on clients
o

*.vud

*.index

Encrypted virtual hard disk files

o

*.evhd

DPM SERVER
FILE AND DIRECTORY EXCLUSIONS

Drive:\Program Files\Microsoft DPM\DPM\XSD

Drive:\Program Files\Microsoft DPM\DPM\Temp\MTA
Note: Delete infected files on protected servers and the DPM server. To prevent data
corruption of replicas and recovery points, configure the antivirus software to delete infected
files rather than automatically cleaning or quarantining them. Automatic cleaning and
quarantining can result in data corruption because these processes cause the antivirus
software to modify files, making changes that DPM cannot detect. Whenever DPM attempts
to synchronize a replica that has been modified by another program, data corruption of the
replica and recovery points can result. Configuring the antivirus software to delete infected
files resolves this problem. For information about configuring your antivirus software to
delete infected files, see the documentation for your antivirus software.
PROCESS EXCLUSIONS

Drive:\Program Files\Microsoft Data Protection Manager\DPM\bin

o
dpmra.exe
C:\Windows\Microsoft.net\Framework\v2.0.50727
o
csc.exe

ISA SERVER 2004/2006

FILES AND DIRECTORY EXCLUSIONS

ISA Server installation folder default is %ProgramFiles%\Microsoft ISA Server

SQL MSDE folders - %ProgramFiles%\Microsoft SQL Server
ISA Server Web cache (ISA Server administrator must define this)

PROCESS EXCLUSIONS

ISA Server Report Summary Generator - %ProgramFiles%\Microsoft ISA

Server\dailysum.exe
ISA Server Report Generator - %ProgramFiles%\Microsoft ISA Server\isarepgen.exe
ISA Server Diagnostic Logging Viewer - %ProgramFiles%\Microsoft ISA
Server\isadlviewer.exe
ISA Server Storage Service - %ProgramFiles%\Microsoft ISA Server\isastg.exe
ISA Server Control Service - %ProgramFiles%\Microsoft ISA Server\mspadmin.exe
ISA Server Web Content Download Service - %ProgramFiles%\Microsoft ISA
Server\w3prefch.exe
ISA Server Firewall Service - %ProgramFiles%\Microsoft ISA Server\wspsrv.exe
SQL 2003 MSDE
o %ProgramFiles%\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe;
o %ProgramFiles%\Microsoft SQL Server\MSSQL$MSFW\sqlservr.exe
Active Directory Lightweight Directory Services (Enterprise Edition only)
o %WinDir%\System32\dsamain.exe

FOREFRONT TMG - 2010

FILES AND DIRECTORY EXCLUSIONS

TMG installation folder (may be changed during installation):

o %ProgramFiles%\Microsoft Forefront Threat Management Gateway
TMG SQL Express and SRS installation folders (not changeable)
o %ProgramFiles%\Microsoft SQL Server\MSSQL10.ISARS%ProgramFiles
%\Microsoft SQL Server\MSSQL10.MSFW
TMG Malware scanning cache (may be changed by TMG administrator)
o %SystemRoot%\Temp\ScanStorage
TMG Log Queue (may be changed by the TMG administrator)
o %ProgramFiles%\Microsoft Forefront Threat Management Gateway\Logs
Web cache(TMG administrator must define this)

PROCESS EXCLUSIONS

TMG Report Summary Generator

o %ProgramFiles%\Microsoft Forefront Threat Management
Gateway\dailysum.exe

TMG Report Generator

o %ProgramFiles%\Microsoft Forefront Threat Management
Gateway\isarepgen.exe
TMG Diagnostic Logging Viewer
o %ProgramFiles%\Microsoft Forefront Threat Management
Gateway\isadlviewer.exe
TMG Managed Control Service
o %ProgramFiles%\Microsoft Forefront Threat Management
Gateway\IsaManagedCtrl.exe
TMG Storage Service
o %ProgramFiles%\Microsoft Forefront Threat Management Gateway\isastg.exe
TMG Administration Component
o %ProgramFiles%\Microsoft Forefront Threat Management
Gateway\mspadmin.exe
TMG Firewall Service
o %ProgramFiles%\Microsoft Forefront Threat Management Gateway\wspsrv.exe
TMG Web Content Download Service
o %ProgramFiles%\Microsoft Forefront Threat Management
Gateway\w3prefch.exe
SQL 2008 Express and SQL 2008 Reporting Services
o %ProgramFiles%\Microsoft SQL
Server\MSSQL10.ISARS\MSSQL\Binn\sqlservr.exe
o %ProgramFiles%\Microsoft SQL
Server\MSSQL10.ISARS\MSSQL\Binn\ReportingServicesService.exe
o %ProgramFiles%\Microsoft SQL
Server\MSSQL10.MSFW\MSSQL\Binn\sqlservr.exe
Active Directory Lightweight Directory Services
o %WinDir%\System32\dsamain.exe

FOREFRONT UAG 2010

FILES AND DIRECTORY EXCLUSIONS

UAG installation folder (may be changed during installation):

o
%ProgramFiles%\Microsoft Forefront Unified Access Gateway
UAG SQL Express and SRS installation folders (not changeable)
o %ProgramFiles%\Microsoft SQL Server\MSSQL10.ISARS%ProgramFiles
%\Microsoft SQL Server\MSSQL10.MSFW
UAG Malware scanning cache (may be changed by UAG administrator)
o %SystemRoot%\Temp\ScanStorage
UAG Log Queue (may be changed by the UAG administrator)
o %ProgramFiles%\Microsoft Forefront Unified Access Gateway\Logs
Web cache(UAG administrator must define this)

PROCESS EXCLUSIONS

UAG Report Summary Generator

o %ProgramFiles%\Microsoft Forefront Unified Access Gateway\dailysum.exe
UAG Report Generator
o %ProgramFiles%\Microsoft Forefront Unified Access Gateway\isarepgen.exe

UAG Diagnostic Logging Viewer

o %ProgramFiles%\Microsoft Forefront Unified Access Gateway\isadlviewer.exe
UAG Managed Control Service
o %ProgramFiles%\Microsoft Forefront Unified Access
Gateway\IsaManagedCtrl.exe
UAG Storage Service
o %ProgramFiles%\Microsoft Forefront Unified Access Gateway\isastg.exe
UAG Administration Component
o %ProgramFiles%\Microsoft Forefront Unified Access Gateway\mspadmin.exe
UAG Firewall Service
o %ProgramFiles%\Microsoft Forefront Unified Access Gateway\wspsrv.exe
UAG Web Content Download Service
o %ProgramFiles%\Microsoft Forefront Unified Access Gateway\w3prefch.exe
SQL 2008 Express and SQL 2008 Reporting Services
o %ProgramFiles%\Microsoft SQL
Server\MSSQL10.ISARS\MSSQL\Binn\sqlservr.exe
o %ProgramFiles%\Microsoft SQL
Server\MSSQL10.ISARS\MSSQL\Binn\ReportingServicesService.exe
o %ProgramFiles%\Microsoft SQL
Server\MSSQL10.MSFW\MSSQL\Binn\sqlservr.exe
Active Directory Lightweight Directory Services
o %WinDir%\System32\dsamain.exe
Forefront UAG DNS-ALG Service
o %ProgramFiles%\Microsoft Forefront Unified Access Gateway\DnsAlgSrv.exe
Forefront UAG Monitoring Manager
o %ProgramFiles%\Microsoft Forefront Unified Access
Gateway\MonitorMgrCom.exe
Forefront UAG Session Manager
o %ProgramFiles%\Microsoft Forefront Unified Access
Gateway\SessionMgrCom.exe
Forefront UAG File Sharing
o %ProgramFiles%\Microsoft Forefront Unified Access Gateway\ShareAccess.exe
Forefront UAG Quarantine Enforcement Server
o %ProgramFiles%\Microsoft Forefront Unified Access Gateway\uagqessvc.exe
Forefront UAG Terminal Services RDP Data
o %ProgramFiles%\Microsoft Forefront Unified Access Gateway\uagrdpsvc.exe
Forefront UAG User Manager
o %ProgramFiles%\Microsoft Forefront Unified Access Gateway\UserMgrCom.exe
Forefront UAG Watch Dog Service
o %ProgramFiles%\Microsoft Forefront Unified Access Gateway\WatchDogSrv.exe
Forefront UAG Log Server
o %ProgramFiles%\Microsoft Forefront Unified Access Gateway\whlerrsrv.exe
Forefront UAG SSL Network Tunneling Server
o %ProgramFiles%\Microsoft Forefront Unified Access Gateway\whlios.exe

APPENDIX A SOURCES
PRIOR COMPILATIONS
http://social.technet.microsoft.com/wiki/contents/articles/953.microsoft-anti-virus-exclusionlist.aspx http://blogs.technet.com/b/jeff_stokes/archive/2010/05/19/anti-virus-exclusions-andyou.aspx
GENERAL EXCLUSIONS
http://support.microsoft.com/kb/822158
DOMAIN CONTROLLERS
http://support.microsoft.com/kb/822158
EXCHANGE
http://technet.microsoft.com/en-us/library/bb332342.aspx
http://technet.microsoft.com/en-us/library/bb332342%28EXCHG.80%29.aspx
http://support.microsoft.com/kb/328841
LYNC
http://technet.microsoft.com/en-us/library/gg195736(v=ocs.14).aspx
CLUSTER SERVERS
http://support.microsoft.com/kb/250355
HYPER-V AND SCVMM
http://support.microsoft.com/kb/961804/en-us
http://support.microsoft.com/kb/2628135
SQL
http://support.microsoft.com/kb/309422
CONFIGURATION MANAGER
http://blogs.technet.com/b/configurationmgr/archive/2010/11/30/configmgr-2007-antivirusscan-and-exclusion-recommendations.aspx
http://blogs.technet.com/b/systemcenterpfe/archive/2013/01/11/updated-system-center2012-configuration-manager-antivirus-exclusions-with-more-details.aspx
http://www.systemcenterblog.nl/2012/05/09/anti-virus-scan-exclusions-for-configurationmanager-2012/

SCOM
http://support.microsoft.com/kb/975931
SHAREPOINT
http://support.microsoft.com/kb/952167
IIS
http://support.microsoft.com/kb/817442
WSUS
http://technet.microsoft.com/en-us/library/dd939908(WS.10).aspx#av
APP-V CLIENTS
http://support.microsoft.com/kb/2576031
MED-V
http://social.technet.microsoft.com/wiki/contents/articles/566.aspx
DPM
http://technet.microsoft.com/en-us/library/ff399439.aspx
ISA
http://technet.microsoft.com/en-us/library/cc707727.aspx
FOREFRONT TMG
http://technet.microsoft.com/en-us/library/cc707727.aspx
FOREFRONT UAG
http://technet.microsoft.com/en-us/library/cc707727.aspx