Antivirus Exclusions for the Server

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

This document contains the list of both files and folders that should be excluded in any other security software on the machine hosting the App Control Server.

Environment

• App Control Server: All Supported Versions
• Microsoft Windows: All Supported Versions

Resolution

Default Install Paths are shown below. If the installation path was customized these paths may need to be adjusted.

• Server 8.11.0 and higher

  Folders:
  C:\Program Files\Bit9\Parity Server\
  C:\Program Files\Bit9\Parity Console\
  
  Files:
  C:\Program Files\Bit9\Parity Server\ParityServer.exe
  C:\Program Files\Bit9\Parity Server\Reporter\ParityReporter.exe
  C:\Program Files\Bit9\Parity Console\php\php.exe
  C:\Program Files\Bit9\Parity Console\php\php-cgi.exe
  C:\Program Files\Bit9\Parity Console\php\php8ts.dll
  

• Server 8.10.4 and lower

  Folders:
  C:\Program Files (x86)\Bit9\Parity Server\
  C:\Program Files (x86)\Bit9\Parity Console\
  
  Files:
  C:\Program Files (x86)\Bit9\Parity Server\ParityServer.exe
  C:\Program Files (x86)\Bit9\Parity Server\Reporter\ParityReporter.exe
  C:\Program Files (x86)\Bit9\Parity Console\php\php.exe
  C:\Program Files (x86)\Bit9\Parity Console\php\php-cgi.exe
  C:\Program Files (x86)\Bit9\Parity Console\php\php8ts.dll
  

If using External Analytics Export

• <Export Directory>\EventTrace-*.bt9
• <Export Directory>\MetadataTrace-*.bt9
• <Export Directory>\NetTrace-*.bt9

Additional Information

• During installation the path for App Control Server may have been changed from the defaults listed above.
• If using SQL Server on the same machine, check with the vendor about best practices for SQL Server.
• Some vendors require a trailing asterisks (*) when entering exclusions. Sub-folders should be included on the exclusion. Please refer to the vendor's documentation
• Windows Defender is enabled by default on Windows machines and also requires these exclusions
• External Analytics files have a date stamp in the file name, the above exclusion paths are an example.