Not Recommended Exclusions

06/19/2020 0 People found this article helpful 87,931 Views

Download

Print

Share

• LinkedIn
• Twitter
• Facebook
• Email
• Copy URL The link has been copied to clipboard

Description

The list below shows items that you must NOT exclude with Capture Client exclusions. If you create an exclusion for any of these items, you open your environment to security risk.

This list is based on the experience of Technical Support and will be updated by our Support team.

If you have an interoperability or false positive issue that you require help to resolve, please open a ticket with SonicWall Capture Client Support.

Resolution

NOT Recommended Exclusions

• Signer identity exclusion for all Microsoft applications

• Signer identity exclusion for all Adobe applications

• Drive letter:\

• Drive letter:\*.*

• Drive letter:\*\

• Drive letter:\Windows\spool\

• C:\*\Java\

• C:\cygwin\

• C:\cygwin64\

• C:\Java\

• C:\jboss-eap-6.4\

• C:\Program Files (x86)\

• C:\Program Files (x86)\Adobe\

• C:\Program Files (x86)\Google\

• C:\Program Files (x86)\Google\Chrome\

• C:\Program Files (x86)\Internet Explorer\

• C:\Program Files (x86)\Java\

• C:\Program Files (x86)\Java\jre version number\

• C:\Program Files (x86)\Java\jre1.8.0_151\bin\jp2launcher.exe

• C:\Program Files (x86)\Java\jre6\bin\

• C:\Program Files (x86)\Microsoft Office\

• C:\Program Files (x86)\Microsoft Office\Office version number\

• C:\Program Files (x86)\Microsoft Office\root\Office16\

• C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.exe

• C:\Program Files(x86)\Java\

• C:\Program Files\

• C:\Program Files\Adobe\

• C:\Program Files\Adobe\Acrobat Reader DC\

• C:\Program Files\Adobe\Reader 10.0\Reader\AcroRd32.exe

• C:\Program Files\cygwin\

• C:\Program Files\cygwin64\

• C:\Program Files\Git\perl.exe

• C:\Program Files\Git\usr\bin\perl.exe

• C:\Program Files\Internet Explorer\

• C:\Program Files\Internet Explorer\iexplore.exe

• C:\Program Files\Java\

• C:\Program Files\Java\*\bin\javac.exe

• C:\Program Files\Microsoft Office\Office16\

• C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE

• C:\Program Files\Tripwire\TE\Agent\jre\bin\java.exe

• C:\Tomcat7\

• C:\tomcat7_2\bin\tomcat7.exe

• C:\tomcat7.0\

• C:\tomcat7\bin\tomcat7.exe

• C:\Users\*\Cygwin\Bin\

• C:\Windows\

• C:\Windows\*\WindowsPowerShell\v1.0\powershell.exe

• C:\Windows\explorer.exe\

• C:\Windows\py.exe

• C:\Windows\setup.exe

• C:\Windows\system32\

• C:\Windows\System32\smss.exe

• C:\Windows\system32\conhost.exe

• C:\windows\system32\consent.exe

• C:\Windows\System32\cscript.exe

• C:\Windows\system32\csrss.exe

• C:\Windows\System32\dllhost.exe

• C:\Windows\System32\dwm.exe

• C:\Windows\System32\explorer.exe

• C:\Windows\System32\LogonUI.exe

• C:\Windows\System32\lsalso.exe

• C:\WINDOWS\system32\lsass.exe

• C:\Windows\System32\lsm.exe

• C:\windows\system32\mmc.exe

• C:\Windows\System32\netsh.exe

• C:\Windows\System32\Ntoskrnl.exe

• C:\Windows\System32\rundll32.exe

• C:\windows\system32\services.exe

• C:\Windows\System32\sihost.exe

• C:\Windows\system32\smss.exe

• C:\Windows\System32\snmp.exe

• C:\Windows\System32\splwow64.exe

• C:\Windows\System32\Spool\

• C:\Windows\System32\spoolsv.exe

• C:\Windows\System32\svchost.exe

• C:\Windows\System32\sysvol\

• C:\Windows\System32\taskeng.exe

• C:\Windows\System32\taskhostex.exe

• C:\Windows\System32\Taskmgr.exe

• C:\Windows\system32\userinit.exe

• C:\Windows\System32\vbscript.dll

• C:\Windows\system32\vssvc.exe

• C:\Windows\System32\WBEM\

• C:\Windows\System32\wbem\WmiApSrv.exe

• C:\Windows\System32\wbem\WmiPrvSE.exe

• C:\Windows\System32\WindowsPowerShell\

• C:\Windows\System32\WindowsPowerShell\v1.0\

• C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe

• C:\Windows\System32\wininit.exe

• C:\Windows\system32\winlogon.exe

• C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\

• C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

• C:\Windows\SYSVOL\

• C:\Windows\SysWOW64\

• C:\Windows\SysWOW64\dllhost.exe

• C:\Windows\SysWOW64\wbem\

• C:\Windows\SysWOW64\wbem\WmiPrvSE.exe

• C:\Windows\Temp\

• C:\Windows\winexesvc.exe

• acrord32.exe

• java.exe

• LogonUI.exe

• vssadmin.exe

• _mprosrv.exe

• *.dll

• *.exe

• *.pdf

• */pythonversion number

• */ruby

• *\*apache-maven*\

• *\bin\java.exe

• \adobe\

• \Device\HarddiskVolume*\

Related Articles

• How to Download and Install Capture Client
• How to Find Tenant ID on Capture Client Management Console
• How to Schedule Reports in Capture Client Management Console.

Categories

• Endpoint Security > Capture Client > Network