Excluding Endpoint Protection/Security from 3rd party Security Software

Products

• Endpoint Protection
• Endpoint Security

Issue/Introduction

The Symantec Endpoint Protection (SEP) or Symantec Endpoint Security (SES) Agent is having a conflict when 3rd party security protection software is installed.

Environment

This article covers exclusions for SEP/SES Agents.

Resolution

Configure the 3rd party security protection software to exclude SEP/SES folders and processes, which will prevent them from monitoring data that is written to or read from the folders.

It is recommended to whitelist all of the processes and folders that are listed below:

Windows

Endpoint Agent Installation Location * (64-bit: 14.3 RU4 and older)	C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\
Endpoint Agent Data Folder Location * (32-bit, and 64-bit 14.3 RU5 and newer)	C:\ProgramData\Symantec\Symantec Endpoint Protection\
Endpoint Service name (SepMasterService)	Sms.dll
Processes	AutoExcl.exe ccSvcHst.exe checksum.exe DevViewer.exe DoScan.exe DWHWizrd.exe PCHSetupRunner.exe SavUI.exe SepLiveUpdate.exe SETDADCollector.exe SETDADMiniDM.exe Smc.exe SmcGui.exe SymCorpUI.exe symerr.exe vietool.exe WSCSAvNotifier.exe

* Need to exclude all subfolders

MacOS

Endpoint Agent Installation Location	/Library/Application Support/Symantec/
Processes	Symdaemon

 

 Linux OS

Installation Directory	/opt/Symantec/symantec_antivirus
LiveUpdate	/opt/Symantec/LiveUpdate/tmp

 

For a detailed list of all the SEP processes, please review the following document: Processes and services used by Endpoint Protection 14
For a detailed list of all the SES processes, please review the following document: What processes and services does Endpoint Security use?