FCS: How to Add Centrally Managed Process Exclusions

FCS: How to Add Centrally Managed Process Exclusions

The FCS console unfortunately does not have a mechanism to add centrally managed process exclusions however since these are controlled by registry keys and values it is possible to create .adm templates and import a process exclusion into existing FCS Policy GPO's

An example of such a .adm file is listed below:

-------------------------------------------------------------------------------------------------------------------------

CLASS MACHINE
CATEGORY !!FCSCategory
 POLICY !!Exclusion_Name

  KEYNAME "SOFTWARE\Policies\Microsoft\Microsoft Forefront\Client Security\1.0\AM\Exclusions\Processes"
   EXPLAIN !!Exclusion_Explain

  Part !!Exclusion_Description DROPDOWNLIST REQUIRED
      VALUENAME "C:\Windows\system32\goodprocess.exe"
      ITEMLIST
   NAME !!Override_Default    VALUE NUMERIC 0 DEFAULT   
      END ITEMLIST
  END PART
 END POLICY

END CATEGORY

[strings]

FCSCategory="Microsoft FCS Threat Override"
Exclusion_Name="FCS Process Exclusion"
Exclusion_Description="FCS Process Exclusion"
Exclusion_Explain="Allows setting process exclusions for FCS so that it does not scan files touched by certain processes Not supported for W2K"
Ignore_Default="Default"

-------------------------------------------------------------------------------------------------------------------------

Keep in mind that process exclusions in FCSv1 are not in effect unless the FCSAM service starts before the process so you may need to do a service dependency to have the excluded service depend on FCS at startup to ensure that the process exclusions is successful.

Leave a Comment
  • Please add 6 and 2 and type the answer here:
  • Post
Wiki - Revision Comment List(Revision Comment)
Sort by: Published Date | Most Recent | Most Useful
Comments
Page 1 of 1 (4 items)
Wikis - Comment List
Sort by: Published Date | Most Recent | Most Useful
Posting comments is temporarily disabled until 10:00am PST on Saturday, December 14th. Thank you for your patience.
Comments
  • KimDitto_MSFT edited Revision 1. Comment: Small edits

  • KimDitto_MSFT edited Revision 2. Comment: Reverting Bad Changes

  • Ed Price MSFT edited Revision 3. Comment: Minor title update. Cleaned up and added tags.

  • Maheshkumar S Tiwari edited Revision 4. Comment: Added Tag

Page 1 of 1 (4 items)