System Variables?

Hello Neil,

reading the article:

This doesn't sound very convincing :smileywink: - significant HDD I/O ... scanning of all of this activity who says that a decent AV product would do this? Even if, say, analyze.exe would be called several hundred times during logon it'll likely be scanned only once. There have been issues with scanning certain applications (3dsmax for example) but these shouldn't be resolved by once and forever excluding them. [Edit: I had to leave yesterday - here's the rest] Indeed I wouldn't feel confident with permanent exclusions on a client. The article is IMO cryptic (or maybe I just can't grasp its intricacies ): Scheduling Anti-Virus Software and Signature updates during Boot [can also considerably slow down a device's initial logon ] - yeah, sure, obvious. Now what's Boot here especially if you also employ Network Access Control (which would then require the updates anyway)? And reading the whole sentence I doubt that I can correctly read and understand English: In addition to AV Scanning Exclusions, Anti-Virus activity scheduled to occur at startup can also considerably slow down a device's initial logon. To me it says "exclusions can slow down" ... :smileysurprised:   

But it's a nice segue back to the System Variables. One question is what should be done if a variable doesn't resolve (I think  the exclusion must be ignored) and which variables should be considered? Would you expect %UserProfile% to work? Keep in mind that they don't necessarily contain a path at all. Oh, would you permit the %PATH% variable? Or recursion? You see, it's not that simple. Apart from that it would save you from explicitly specifying the "short names". Then there's the question when to resolve them - at startup and whenever a policy is changed (how to evaluate policy compliance is another matter)? To me it's a can of worms ...

Christian

Christian

Hello Neil,

reading the article:

This doesn't sound very convincing :smileywink: - significant HDD I/O ... scanning of all of this activity who says that a decent AV product would do this? Even if, say, analyze.exe would be called several hundred times during logon it'll likely be scanned only once. There have been issues with scanning certain applications (3dsmax for example) but these shouldn't be resolved by once and forever excluding them. [Edit: I had to leave yesterday - here's the rest] Indeed I wouldn't feel confident with permanent exclusions on a client. The article is IMO cryptic (or maybe I just can't grasp its intricacies ): Scheduling Anti-Virus Software and Signature updates during Boot [can also considerably slow down a device's initial logon ] - yeah, sure, obvious. Now what's Boot here especially if you also employ Network Access Control (which would then require the updates anyway)? And reading the whole sentence I doubt that I can correctly read and understand English: In addition to AV Scanning Exclusions, Anti-Virus activity scheduled to occur at startup can also considerably slow down a device's initial logon. To me it says "exclusions can slow down" ... :smileysurprised:   

But it's a nice segue back to the System Variables. One question is what should be done if a variable doesn't resolve (I think  the exclusion must be ignored) and which variables should be considered? Would you expect %UserProfile% to work? Keep in mind that they don't necessarily contain a path at all. Oh, would you permit the %PATH% variable? Or recursion? You see, it's not that simple. Apart from that it would save you from explicitly specifying the "short names". Then there's the question when to resolve them - at startup and whenever a policy is changed (how to evaluate policy compliance is another matter)? To me it's a can of worms ...

Christian

Christian