On-Access General Exclusions on Windows Servers

[shocko]

Guys, running a windows estate of ~ 1000 servers. On-Access scan is disabled and I want it enabled for security. That said, wondering what experienced people are doing around:

• Low risk processes setup
• OAS exclusions
• ODS exclusions

Microsoft publish this list of recommendations and a baseline one for Windows Servers here. Is there any guide on how to set them up specif to VSE or ENS though? MS mention exclusions but not sure if that means (in the VSE/ENS content) to use low risk processes that do not scan on read/write or exclude for all processes and ODS etc. 

Anyone with experience managing VSE/ENS on a large server estate would be much appreciated. Particularly how you justify risk of exclusions etc. 

[Former Member · Accepted solution]

Hi @shocko 

For ENS:

How to improve performance with Endpoint Security 10.x
https://kb.mcafee.com/agent/index?page=content&id=KB88205

Consolidated list of Endpoint Security and VirusScan Enterprise exclusion articles
https://kb.mcafee.com/agent/index?page=content&id=KB66909

Here are the important take away’s from these KBs:

• ENS performance can be improved many ways i.e.:
  Utilizing low/ high risk processes, disabling archive scanning, keeping exclusions to a minimum, using scan avoidance  
• If using ENS OAS “Let McAfee Decide”,  you can benefit from the AMCORE trust model.
  What is the AMCORE trust model?
  The AMCORE trust model means that you no longer need A LOT of the manually set exclusions as you used to in VSE. All the exclusions listed in KB66909 and many more are included in the trust model and no longer need to be added manually. In fact adding them manually is duplicating the efforts and can resort in negative performance impacts.
  For full details, read: https://community.mcafee.com/t5/Documents/Explanation-of-AMCore-Trust-Model-v1p3-pdf/ta-p/550630
  
  What are the benefits of leveraging the scan avoidance?
  Performance, performance, performance. Security, Security, Security 😊 – where manually setting exclusions works in a very rigid black and white way – it’s either excluded or not, the AMCORE trust excludes the items in a more intelligent way, it ensures that security is upkept whilst allowing for the performance benefits.
• Reducing the amount of exclusions you use also is beneficial for security and performance. You should look to take the approach of only apply what’s needed (and yes, this requires configuring different policies for different systems), keep the amount of exclusions to absolute minimum.

The above is only relevant for ENS OAS. For ODS you may need to add specific exclusions but typically the whole point of running the ODS task is to scan those locations that you've excluded from OAS scanning.

VSE is less intelligent than ENS. You should use low/ high risk profiles as with ENS so you can properly define a process exclusion. The main important thing to remember is that is you exclude i.e. test.exe within the default exclusions, this is a file exclusion only - the process will still be scanned. To exclude the process from being scanned, you need to define it as a low risk process and potentially disable scanning for low risk processes. For VSE systems you will need to add the recommended MS exclusions. However I would encourage a migration of those systems to ENS to benefit from the new features and scan architecture.

[bodysoda]

This is one of the good explanations I've so far seen online. Thanks