When using the [PROGRAM_FILES] prefix variable with for application control exceptions, files/folders are not being properly excluded. On 64bit machines the "C:\Program Files (x86)" portion of the exclusion works properly, but the "C:\Program Files" does not.
This issue is fixed in Symantec Endpoint Protection 14.0. For information on how to obtain the latest build of Symantec Endpoint Protection, see Download the latest version of Symantec Endpoint Protection.