Configuring Exceptions in Endpoint Protection Manager

Products

• Endpoint Protection

Issue/Introduction

A file, folder, file extension, or application needs to be excluded from being scanned by one or more features of the Symantec Endpoint Protection (SEP) client. Such exclusions can be configured for managed SEP clients using Centralized Exceptions policies in the Symantec Endpoint Protection Manager (SEPM) console for items such as:

• Application Control
• Security Risks (Auto-Protect and/or Scheduled and on-demand)
• SONAR

Environment

• Symantec Endpoint Protection Client
• Symantec Endpoint Protection Manager (SEPM)

Resolution

Step 1: Create or Modify an Existing Exception Policy

1. Log into the SEPM and click Policies.
2. Under Policies, click Exceptions.
3. Depending on your objective, proceed with one of the following:
   • To create a new policy: Under Tasks, click Add an Exception policy. This will create and open a new Exceptions Policy.
   • To modify an existing policy: Double-click the policy, or right-click it and select Edit.

Step 2: Create or Modify Exceptions

1. In SEPM, click Policies.
2. Under Policies click Exceptions.
3. Open the Exception Policy in question
4. In the left pane, click Exceptions policy and select Edit the policy under Tasks.
5. In the policy, select Exceptions.
6. Click the Add button to open a drop-down menu. Move the cursor over the Operating System exception type (Windows Exceptions, Mac Exceptions, or Linux Exceptions) to open a second drop-down menu.
7. Select the appropriate option for the exception you want to create. See the below Exception Types References for a list of available options.
8. Enter the appropriate information for the item to be excluded. For Extensions, File, and Folder exclusions, specify the type of scans that will be excluded from the drop-down menu or menus.
   • (Optional) Repeat steps 6 through 8 to add any other Security Risk Exceptions to the policy.
     Click OK.
9. Assign the policy to a group within the SEPM.

Exception Types References

Windows Exceptions

• Application
• Application to Monitor
• Extensions
• File
• File Access
• Folder
• Known Risks
• Trusted Web Domain
• Tamper Protection Exception
• DNS or Host File Change Exception
• Certificate

Mac Exceptions

• File or Folder

Linux Exceptions

• Folder
• Extensions

Unsure what type of exception to make? See Which Windows exceptions do I use for what type of scan?

Wildcard Support

The 14.3 RU5 SEPM added support for the wildcards asterisk (*) and question mark (?) anywhere in a file path for Windows clients using 14.3 RU5 and newer. Rather than adding each file by name, you may use wildcards to exclude groups of files and folders from scans.  Prior to 14.3 RU5 client, Wildcard variables such as * and ? are not supported for Known Risks, File, or Folder exceptions. The ? wildcard is supported for Extension exceptions. The Folder exceptions screen will accept * and ? but they will be treated as literal characters not wildcard variables.

For File and Folder-based exclusions, the Full Path to the file must be specified, unless a "Prefix Variable" is selected. If a "Prefix Variable" is selected, the path specified should be relative to the selected "Prefix Variable"


 

Glossary of File/Folder Prefix Variables

 

NAME OF PREFIX	Description
PROGRAM_FILES_COMMON	A folder for components that are shared across applications. A typical path is C:\Program Files\Common Files
SYSTEM	The Windows System folder. A typical path is C:\Windows\System32 or C:\WINNT\System32
COMMON_PROGRAMS	The file system folder that contains the folders for the common program groups that appear on the Start menu for all users. A typical path is C:\Documents and Settings\All Users\Start Menu\Programs
COMMON_DOCUMENTS	The file system folder that contains documents that common to all users. A typical path is C:\Documents and Settings\All Users\Documents
PROGRAM_FILES	The Program Files folder. A typical path is C:\Program Files
COMMON_DESKTOPDIRECTORY	The file system folder that contains files and folders that appear on the desktop for all users. A typical path is C:\Documents and Settings\All Users\Desktop
WINDOWS	The Windows folder or SYSROOT. This corresponds to the %windir% or %SYSTEMROOT% environmental variables. A typical path is C:\Windows or C:\WINNT
COMMON_APPDATA	The file system folder containing application data for all users. A typical path is C:\Documents and Settings\All Users\Application Data
COMMON_STARTUP	The file system folder that contains all the programs that appear in the Startup folder for all users. A typical path is C:\Documents and Settings\All Users\Start Menu\Programs\Startup
USER_PROFILE	File system folders that correspond to all the users.
SYSTEM_DRIVE	The SYSTEM_DRIVE variable indicates the location where the Windows operating system is installed

 

Additional Information

• For more information please see Exceptions Policy
• What's new for all releases of Symantec Endpoint Protection (SEP) 14.x