Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 1 subscriber
  • Views 1358 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Completely exempt folder and contents - how?

ipgsophos

Hi,

Is there some documentation or can someone let me know all of the places in the Enterprise Console where I need to add an exclusion if i want to prevent Sophos from taking any action at all on a folder and its contents (recursively), for example C:\MyExemptFolder?

Thanks

:37239


This thread was automatically locked due to age.
  • 0

    Hello ipgsophos,

    dunno what any action at all encompasses in this context. Basically you have On-Access and adding the folder(s) - it has to be a complete exact path with or without a device/volume identifier - in the Windows Exclusions tab should apply to everything in there. The Windows Exclusions from the Extensions and Exclusions ... button on the bottom of the policy edit main window work similarly for scans.

    Usual question - why do you need this?

    HTH

    Christian 

    :37269
  • 0

    Hi,

    I have a third party application that updates itself by copying files from a shared network location to the local drive. As part of the procedure it checks for running instances of itself before proceeding. It fails with an access denied message if the "Sophos Anti-Virus status reporter" service is running. I have posted about this before more than a year ago but still have no solution other than stopping/killing the service. I'm guessing Sophos is interpreting the behavior as suspicious but I cannot work out how to exempt it.

    Thanks

    :37277
  • 0

    Ah, I remember - didn't look up your previous posts. Did you ever contact Support? 

    Re-reading, the issue is related to the Status Reporter service. It is not involved in scanning at all but it "talks" to WSC. Guess you don't get an alert from SAV and it's not Sophos which (actively, i.e. as result of scanning) blocks the access. Rather I assume it is e.g. a Windows resource the Status Reporter legitimately holds with an exclusive lock. 

    Is it clear at which point the "Access denied" occurs or is this just somewher?

    Christian

    :37285