Anti-Virus Exclusions

Database Server Exclusions

The following files should be excluded from anti-virus (AV) scanning on all SQL servers:

  • .mdf
  • .ldf
  • .ndf
  • .bak
  • .trn
Directory items that should be excluded:
  • Analysis Services
    • %ProgramFiles%\Microsoft SQL Server\MSSQL.X\OLAP\Data
    • %ProgramFiles%\Microsoft SQL Server\MSSQL.X\OLAP\Log
  • Reporting Services
    • %ProgramFiles%\Microsoft SQL Server\MSRS<versionNumber>.<Instance Name>\Reporting Services\Logs
Processes that should be excluded or marked as low-risk:
  • SQL Server 2012 and higher
    • %ProgramFiles%\Microsoft SQL Server\<Instance_ID>.<Instance Name>\MSSQL\Binn\SQLServr.exe
    • %ProgramFiles%\Microsoft SQL Server\<Instance_ID>.<Instance Name>\Reporting Services\ReportServer\Bin\ReportingServicesService.exe
    • %ProgramFiles%\Microsoft SQL Server\<Instance_ID>.<Instance Name>\OLAP\Bin\MSMDSrv.exe
  • SQL Server 2008 R2
    • %ProgramFiles%\Microsoft SQL Server\MSSQL10_50.<Instance Name>\MSSQL\Binn\SQLServr.exe
    • %ProgramFiles%\Microsoft SQL Server\MSSQL10_50.<Instance Name>\Reporting Services\ReportServer\Bin\ReportingServicesService.exe
    • %ProgramFiles%\Microsoft SQL Server\MSSQL10_50.<Instance Name>\OLAP\Bin\MSMDSrv.exe
  • SQL Server 2008
    • %ProgramFiles%\Microsoft SQL Server\MSSQL10.<Instance Name>\MSSQL\Binn\SQLServr.exe
    • %ProgramFiles%\Microsoft SQL Server\MSSQL10.<Instance Name>\Reporting Services\ReportServer\Bin\ReportingServicesService.exe
    • %ProgramFiles%\Microsoft SQL Server\MSSQL10.<Instance Name>\OLAP\Bin\MSMDSrv.exe

REFERENCE: https://support.microsoft.com/en-us/kb/309422

Application Server Exclusions

  • IIS
    • IIS Logs: C:\inetpub\logs\LogFiles\W3SVC1
    • "%SystemDrive%\inetpub\temp\IIS Temporary Compressed Files" directory
  • Microsoft.NET temporary files
    • C:\Windows\Microsoft.NET\Framework\v.2.0.50727\Temporary ASP.NET Files\
  • NewWorld ERP
    • {InstallDrive}\Octopus\
    • C:\Program Files\erl10.2
    • C:\Program Files (x86)\RabbitMQ Server

    • C:\inetpub\tyleroot

    • {Install Directory}:\Program Files (x86)\Tyler Technologies\

    • C:\Program Files\Tyler Technologies\ (if applicable)

    • C:\Program Files\erl6.0 (if applicable)

Processes that should be excluded or marked as low risk:
  • c:\windows\System32\inetsrv\w3wp.exe
  • c:\windows\SysWOW64\inetsrv\w3wp.exe