Global Exclusions
Exclusions can apply to on-access and on-demand scanning. Based on the object of the exclusion, there are a number of different types of exclusions.
For information on creating exclusions for scans, see Configure Global Exclusions.
Windows 10 offers an optional case-sensitive file system. How the Windows device is configured can affect how you enter the search criteria in the search field on the Global Exclusions page.
Process
This excludes the security scanning of the image in memory and the action of the process. These are the most common exclusions that you will use with AV Defender. They are typically used when troubleshooting application conflicts, performance issues, and application performance issues. You can also configure process exclusions for on-access scanning, Active Virus Control, and Intrusion Detection Systems.
When configuring a process exclusion, only full file paths with an extension are valid. You can also include environment variables that appear in the drop-down menu when specifying a path for exclusion. Custom environment variables are not supported.
If you exclude a process, its actions are also excluded, however the actions of its "children" are not. For example, if iexplore.exe is excluded and it runs virus.exe, AV Defender will not scan the virus.exe file when it runs. However, if virus.exe then attempts to execute killmypc.exe, AV Defender will scan it and catches it if it is malicious.
There is no limit to the number of process that can be excluded.
File/Folder
This excludes the file image from being scanned. You should only configure this in circumstances where the scanning itself is causing issues or if removal from the files can be damaging. Example exclusions include:
- File: Only the specified file is excluded from security scanning.
- Folder: All files in a specified folder and all of its subfolders are excluded from security scanning.
- Extension: All files with the specified extension are excluded from security scanning.
Examples of using File/Folder exclusions include backup destination locations, database files and PST or OST files.
Network
This excludes all network-level filtering from security scanning including antivirus and anti-malware scanning of TCP traffic, content filtering by category, anti-phishing, and search advisors/browser toolbars. Use Network exclusions to troubleshoot issues with any network centered application including:
- Being unable to access server applications.
- Being unable to connect to network resources.
- Being unable to connect to the Internet.
- Web pages not functioning as expected.
Use scan exclusions in special circumstances or following Microsoft or Bitdefender recommendations. When configuring exclusions, note that N-able N-central does not support the use of wildcard characters for excluding files and file types. If you have an EICAR test file that you use periodically to test anti-malware protection, exclude it from on-access scanning.
Best practice
For the best results, use the exclusion type that accomplishes specific goals:
- Process: Used to resolve application conflicts, performance issues, and reduce impact on key business applications.
- File/Folder - Used to avoid false positive errors or for heavy traffic folders, such as backup destinations.
- Network: Used to exclude a web site from being scanned. Exclusions will apply to all modules.
To avoid false positives, exclude the following MSPA executables from the C:\ProgramData\GetSupportService_N-Central\Updates\ folder:
- MSPA4NCentral-6.77.77-BUILD-20161219-B-20161221163111.exe
- MSPA4NCentral-6.80.00-BUILD-20170120-C-20170130181221.exe
- MSPA4NCentral-6.80.01-BUILD-20170131-20170131113836.exe
- MSPA4NCentral-6.80.10-BUILD-20170405-20170410160818.exe
- MSPA4NCentral-6.80.17-BUILD-20170801-20170810174900.exe
- Update_20161213081614.exe
- Update_20170321174328.exe
- Update_20170525043038.exe
- Update_20170621174604.exe
- Update_20171117142950.exe
- Update_20180302141746.exe
- Update_20180730120602.exe
Also exclude the following folders and files
- C:\Program Files (x86)\N-able Technologies\Reactive\bin\
- C:\Program Files (x86)\N-able Technologies\Reactive\bin\NableCommandPromptManager32.exe
- C:\Program Files (x86)\N-able Technologies\Reactive\bin\NableCommandPromptManager64.exe
- C:\Program Files (x86)\N-able Technologies\Reactive\bin\NableReactiveManagement.exe
If you are using MSPAnywhere/Take Control, add these exclusions:
- C:\Program Files (x86)\BeAnywhere Support Express\GetSupportService_N-Central\
- C:\Program Files (x86)\BeAnywhere Support Express\GetSupportService_N-Central\BASupSrvc.exe
- C:\Program Files (x86)\BeAnywhere Support Express\GetSupportService_N-Central\BASupSrvcCnfg.exe
Patch Manager Engine exclusions for third party AV software
N-able N-central software (agents and probes) must be excluded from third party antivirus scans in order to function properly.
N-able recommends that you add the following path to the list of exclusions from security scans:
Folders
- <install path>\N-able Technologies\
- %Programfiles(x86)%\MspPlatform\PME
- %Programfiles(x86)%\MspPlatform\FileCacheServiceAgent
- %Programfiles(x86)%\MspPlatform\RequestHandlerAgent
- %ProgramData%\MspPlatform
-
%Programfiles(x86)%\BeAnywhere Support Express
-
%Programfiles(x86)%\N-able Technologies\Windows Agent
-
%Programfiles(x86)%\SolarWinds MSP\Ecosystem Agent
Files
- %Programfiles(x86)%\MspPlatform\FileCacheServiceAgent\FileCacheServiceAgent.exe
- %Programfiles(x86)%\MspPlatform\PME\ThirdPartyPatch\7z.exe
- %Programfiles(x86)%\MspPlatform\PME\ThirdPartyPatch\ThirdPartyPatch.exe
- %Programfiles(x86)%\MspPlatform\PME\Installers\CacheServiceSetup.exe
- %Programfiles(x86)%\MspPlatform\PME\Installers\RPCServerServiceSetup.exe
- %Programfiles(x86)%\MspPlatform\PME\Diagnostics\PME.Diagnostics.exe
- %Programfiles (x86)\MspPlatform\PME\PME.Agent.exe
- %Programfiles(x86)%\MspPlatform\RequestHandlerAgent\RequestHandlerAgent.exe
-
%Programfiles(x86)%\N-able Technologies\Windows Agent\bin\Agent.exe
-
%Programfiles(x86)%\MspPlatform\PME\Installers\FileCacheServiceAgentSetup.exe
-
%Programfiles(x86)%\MspPlatform\PME\Installers\RequestHandlerAgentSetup.exe
This is not required for security solutions integrated with N-able N-central; for example, AV Defender.
Your firewall must be not blocking following communication channels:
HTTP and HTTPS communication (port 80 and port 443) between the FileCacheServiceAgent windows service (%Programfiles(x86)%\MspPlatform\FileCacheServiceAgent\FileCacheServiceAgent.exe) and the sis.n-able.com server.
If you use probe, then firewall must not block communication between the FileCacheServiceAgent windows service and the Probe machine on port 15000.
Expandable variables
Expandable variables are applied for File Scan, Quick and Full scans and on the Behavioral Scan module. The exclusions are expanded at run time, so that filters use the list of exclusions already expanded and normalized.
| Variable | Folder Id |
|---|---|
| %windir% | FOLDERID_Windows |
| %system% | FOLDERID_System |
| %system(x86)% | FOLDERID_SystemX86 |
| %programfiles% | FOLDERID_ProgramFiles |
| %programfiles(x86)% | FOLDERID_ProgramFilesX86 |
| %commonprogramfiles% | FOLDERID_ProgramFilesCommon |
| %commonprogramfiles(x86)% | FOLDERID_ProgramFilesCommonX86 |
| %commonappdata% | FOLDERID_ProgramData |
| %programdata% | FOLDERID_ProgramData |
| %allusersprofile% | FOLDERID_ProgramData |
| %commondocuments% | FOLDERID_PublicDocuments |
| %commondesktop% | FOLDERID_PublicDesktop |
| %commonmusic% | FOLDERID_PublicMusic |
| %commonvideo% | FOLDERID_PublicVideos |
| %commonpictures% | FOLDERID_PublicPictures |
| %userprofile% | FOLDERID_Profile |
| %appdata% | FOLDERID_RoamingAppData |
| %localappdata% | FOLDERID_LocalAppData |
| %mydocuments% | FOLDERID_Documents |
| %desktop% | FOLDERID_Desktop |
| %mymusic% | FOLDERID_Music |
| %myvideo% | FOLDERID_Videos |
| %mypictures% | FOLDERID_Pictures |
Pre-configured Exclusions
By default, AV Defender includes preconfigured exclusions following guidelines provided by N-able N-central and Microsoft. These preconfigured exclusions are embedded in AV Defender and are not subject to user modification. Files are located in the associated N-able Technologies agent/probe folders on the device or server.
Windows agent exclusions
| agent.exe | NAAgentImplServer.exe |
| AgentMaint.exe | NableAVDBridge.exe |
| AgentMonitor.exe | NableAVDUSBridge.exe |
| AVDIU.exe | NRMInstallHelper.exe |
| BASupTSHelper.exe | PIU.exe |
| bitsadmin.exe | Popup.exe |
| ESCleaner.exe | ProxyConfig.exe |
| KillWTSMessageBox.exe | RebootMessage.exe |
Windows probe exclusions
| AMTPowerManager.exe | VmWareClient.exe |
| NableUpdateDiagnose.exe | wsp.exe |
| NableUpdateService.exe | WSPMaint.exe |
| RemoteService.exe | WSPMonitor.exe |
Other
- NableAVDBridge.exe
- NableAVDUSBridge.exe
- ThirdPartyPatch.exe
- BASupApp.exe
Backup Manager exclusions
Files are located in the associated Backup Manager folders on the device or server.
| BackupIP.exe | mysql.exe |
| BRMigrationTool.exe | InstallDriver.exe |
| ClientTool.exe | vddkReporter.exe |
| VdrAgent.exe | vmware-vdiskmanager.exe |
| BackupUP.exe | BackupFP.exe |
| ProcessController.exe | BackupUP.exe |
| BackupFP.exe | BackupIP.exe |
| xtrabackup.exe | vmware-mount.exe |
| vmware-mount.exe | vmware-vdiskmanager.exe |