В ходе настройки политик управления клиентами любого антивирусного ПО необходимо определять список каталогов, имён процессов или даже расширений фалов, которые должны исключаться из Real-Time сканирования. Постараюсь собрать в одном месте информацию о рекомендуемых параметрах исключений и по мере необходимости буду его корректировать. Стоит отметить, что список составлен исходя из приложений, которые эксплуатируются в моём рабочем окружении. Список разделен по основным категориям сервисов и там где возможно есть ссылки на официальные рекомендации производителей ПО. Во всех случаях подразумевается что программное обеспечение установлено в каталоги «по умолчанию».
Общие рекомендации
|
Windows Update files
|
%windir%\SoftwareDistribution\Datastore\DataStore.edb
%windir%\SoftwareDistribution\Datastore\Logs\edb*.jrs
%windir%\SoftwareDistribution\Datastore\Logs\edb.chk
%windir%\SoftwareDistribution\Datastore\Logs\tmp.edb
%windir%\SoftwareDistribution\Datastore\Logs\*.log
|
|
Windows Security files
|
%windir%\Security\database\*.chk
%windir%\Security\database\*.edb
%windir%\Security\database\*.jrs
%windir%\Security\database\*.log
%windir%\Security\database\*.sdb
|
|
Group Policy related files
|
%AllUsersProfile%\ntuser.pol
%SystemRoot%\System32\GroupPolicy\Machine\Registry.pol
|
|
Paging files
|
pagefile.sys
%SystemDrive%\pagefile.sys
|
Источники информации:
Контроллеры домена Active Directory
| NTDS database files |
%windir%\NTDS\ntds.dit
%windir%\NTDS\ntds.pat
|
| NTDS transaction log files |
%windir%\NTDS\edb*.log
%windir%\NTDS\res*.log
%windir%\NTDS\edb*.jrs
|
| NTDS working files |
%windir%\NTDS\temp.edb
%windir%\NTDS\edb.chk
|
| FRS working files |
%windir%\ntfrs\jet\sys\edb.chk
%windir%\ntfrs\jet\ntfrs.jdb
%windir%\ntfrs\jet\log\*.log
%windir%\ntfrs\jet\log\*.jrs
|
| DFS Replica files |
%windir%\SYSVOL_DFSR\domain
%windir%\SYSVOL_DFSR
|
| DFS DB and working files |
%SystemDrive%\System Volume Information\DFSR
%SystemDrive%\System Volume Information\DFSR\$db_normal$
%SystemDrive%\System Volume Information\DFSR\FileIDTable_*
%SystemDrive%\System Volume Information\DFSR\SimilarityTable_*
%SystemDrive%\System Volume Information\DFSR\Config\*.XML
%SystemDrive%\System Volume Information\DFSR\database_*
%SystemDrive%\System Volume Information\DFSR\database_*\$db_dirty$
%SystemDrive%\System Volume Information\DFSR\database_*\$db_clean$
%SystemDrive%\System Volume Information\DFSR\database_*\$db_lost$
%SystemDrive%\System Volume Information\DFSR\database_*\dfsr.db
%SystemDrive%\System Volume Information\DFSR\database_*\fsr.chk
%SystemDrive%\System Volume Information\DFSR\database_*\*.frx
%SystemDrive%\System Volume Information\DFSR\database_*\*.log
%SystemDrive%\System Volume Information\DFSR\database_*\fsr*.jrs
%SystemDrive%\System Volume Information\DFSR\Private
|
| FRS Replica files |
%windir%\SYSVOL\domain
%windir%\SYSVOL
|
| FRS Staging directory |
%windir%\SYSVOL\staging\domain
%windir%\SYSVOL\staging areas
|
| FRS Preinstall directory |
%windir%\SYSVOL\domain\DO_NOT_REMOVE_NtFrs_PreInstall_Directory
|
| Processes |
%SystemRoot%\System32\ntfrs.exe
%SystemRoot%\System32\dfsr.exe
%SystemRoot%\System32\dfsrs.exe
|
Источники информации:
Серверы с ОС Windows Server 2000 – 2016 с распространенными серверными ролями
|
Cluster Service files
|
%QuorumDrive%\MSCS (Например Q:\MSCS)
%QuorumDrive%\Cluster (Например Q:\Cluster)
%SystemRoot%\Cluster
|
|
DHCP Server files
|
%SystemRoot%\System32\dhcp\*.chk
%SystemRoot%\System32\dhcp\*.edb
%SystemRoot%\System32\dhcp\*.jrs
%SystemRoot%\System32\dhcp\*.log
%SystemRoot%\System32\dhcp\dhcp.mdb
%SystemRoot%\System32\dhcp\dhcp.pat
%SystemRoot%\System32\dhcp\backup\*.mdb
%SystemRoot%\System32\dhcp\backup\*.log
%SystemRoot%\System32\dhcp\backup\*.chk
|
|
DNS Server files
|
%SystemRoot%\System32\dns\*.dns
%SystemRoot%\System32\dns\*.log
%SystemRoot%\System32\dns\BOOT
%SystemRoot%\System32\dns.exe
|
|
WINS Server files
|
%SystemRoot%\System32\wins\*.chk
%SystemRoot%\System32\wins\*.log
%SystemRoot%\System32\wins\*.mdb
|
|
Certificate Services files
|
%SystemRoot%\System32\catroot2\*.edb
%SystemRoot%\System32\catroot2\*.chk
%SystemRoot%\System32\catroot2\*.log
%SystemRoot%\System32\catroot2\*.jrs
|
|
TS/RDS Licensing files
|
%SystemRoot%\System32\lserver\*.chk
%SystemRoot%\System32\lserver\*.edb
%SystemRoot%\System32\lserver\*.log
%SystemRoot%\System32\lserver\*.tmp
%SystemRoot%\System32\lserver\*.jrs
|
|
Print Server files
|
%SystemRoot%\System32\spool\PRINTERS\*.SHD
%SystemRoot%\System32\spool\PRINTERS\*.SPL
|
| IIS Web Server |
%SystemRoot%\IIS Temporary Compressed Files
%SystemDrive%\inetpub\temp\IIS Temporary Compressed Files
%SystemDrive%\inetpub\logs
%SystemRoot%\System32\LogFiles
%SystemRoot%\SysWow64\LogFiles
%SystemRoot%\system32\inetsrv\w3wp.exe
%SystemRoot%\SysWOW64\inetsrv\w3wp.exe
|
Источники информации:
Серверы с Microsoft Exchange Server 2000 - 2016
| Exchange Server Common Folders |
%SystemDrive%\inetpub\temp\IIS Temporary Compressed Files
%SystemRoot%\IIS Temporary Compressed Files
%SystemRoot%\System32\Inetsrv
%SystemDrive%\inetpub\logs
%Winnt%\Cluster
%SystemRoot%\Cluster
%SystemDrive%\DAGFileShareWitnesses
%windir%\Microsoft.NET\Framework64\v2.0.50727\Temporary ASP.NET Files
%windir%\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files
|
| Exchange Server Common File Name Extensions |
.config
.dia
.wsb
.chk
.log
.edb
.stm
.jrs
.jsl
.que
.lzx
.ci
.wid
.dir
.000
.001
.002
.cfg
.grxml
.dsc
.txt
.bin
.xml
|
| Exchange Server Common Processes |
Cdb.exe
Cidaemon.exe
Cluster.exe
Clussvc.exe
ComplianceAuditService.exe
%ExchangeInstallPath%Bin\ComplianceAuditService.exe
Dsamain.exe
%SystemRoot%\System32\Dsamain.exe
EdgeCredentialSvc.exe
Microsoft.Exchange.EdgeCredentialSvc.exe
%ExchangeInstallPath%Bin\Microsoft.Exchange.EdgeCredentialSvc.exe
EdgeTransport.exe
%ExchangeInstallPath%Bin\EdgeTransport.exe
ExFBA.exe
GalGrammarGenerator.exe
Inetinfo.exe
%SystemRoot%\System32\inetsrv\inetinfo.exe
W3wp.exe
%SystemRoot%\System32\inetsrv\W3wp.exe
Emsmta.exe
Mssearch.exe
Mad.exe
Microsoft.Exchange.AddressBook.Service.exe
Microsoft.Exchange.AntispamUpdateSvc.exe
%ExchangeInstallPath%Bin\Microsoft.Exchange.AntispamUpdateSvc.exe
Microsoft.Exchange.ContentFilter.Wrapper.exe
%ExchangeInstallPath%TransportRoles\agents\Hygiene\Microsoft.Exchange.ContentFilter.Wrapper.exe
%ExchangeInstallPath%Bin\Microsoft.Exchange.Diagnostics.Service.exe
Microsoft.Exchange.Cluster.Replayservice.exe
Microsoft.Exchange.EdgeSyncSvc.exe
%ExchangeInstallPath%Bin\Microsoft.Exchange.EdgeSyncSvc.exe
Microsoft.Exchange.Imap4.exe
%ExchangeInstallPath%FrontEnd\PopImap\Microsoft.Exchange.Imap4.exe
Microsoft.Exchange.Imap4service.exe
%ExchangeInstallPath%ClientAccess\PopImap\Microsoft.Exchange.Imap4service.exe
Microsoft.Exchange.Infoworker.Assistants.exe
Microsoft.Exchange.Monitoring.exe
Microsoft.Exchange.Notifications.Broker.exe
%ExchangeInstallPath%Bin\Microsoft.Exchange.Notifications.Broker.exe
Microsoft.Exchange.Pop3.exe
%ExchangeInstallPath%FrontEnd\PopImap\Microsoft.Exchange.Pop3.exe
Microsoft.Exchange.Pop3service.exe
%ExchangeInstallPath%ClientAccess\PopImap\Microsoft.Exchange.Pop3service.exe
Microsoft.Exchange.ProtectedServiceHost.exe
%ExchangeInstallPath%Bin\Microsoft.Exchange.ProtectedServiceHost.exe
Microsoft.Exchange.RPCClientAccess.Service.exe
%ExchangeInstallPath%Bin\Microsoft.Exchange.RPCClientAccess.Service.exe
Microsoft.Exchange.Search.Exsearch.exe
Microsoft.Exchange.Search.Service.exe
%ExchangeInstallPath%Bin\Microsoft.Exchange.Search.Service.exe
Microsoft.Exchange.Servicehost.exe
%ExchangeInstallPath%Bin\Microsoft.Exchange.Servicehost.exe
MSExchangeADTopologyService.exe
%ExchangeInstallPath%Bin\Microsoft.Exchange.Directory.TopologyService.exe
MSExchangeFDS.exe
MSExchangeMailboxAssistants.exe
%ExchangeInstallPath%Bin\MSExchangeMailboxAssistants.exe
MSExchangeMailboxReplication.exe
%ExchangeInstallPath%Bin\MSExchangeMailboxReplication.exe
MSExchangeMigrationWorkflow.exe
%ExchangeInstallPath%Bin\MSExchangeMigrationWorkflow.exe
MSExchangeMailSubmission.exe
%ExchangeInstallPath%Bin\MSExchangeSubmission.exe
MSExchangeRepl.exe
%ExchangeInstallPath%Bin\MSExchangeRepl.exe
MSExchangeTransport.exe
%ExchangeInstallPath%Bin\MSExchangeTransport.exe
MSExchangeTransportLogSearch.exe
%ExchangeInstallPath%Bin\MSExchangeTransportLogSearch.exe
MSExchangeThrottling.exe
%ExchangeInstallPath%Bin\MSExchangeThrottling.exe
Msftefd.exe
Msftesql.exe
Noderunner.exe
%ExchangeInstallPath%Bin\Search\Ceres\Runtime\1.0\Noderunner.exe
OleConverter.exe
%ExchangeInstallPath%Bin\OleConverter.exe
ParserServer.exe
%ExchangeInstallPath%Bin\Search\Ceres\ParserServer\ParserServer.exe
Powershell.exe
%SystemRoot%\System32\WindowsPowerShell\v1.0\Powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
SESWorker.exe
SpeechService.exe
Store.exe
Microsoft.Exchange.Store.Service.exe
%ExchangeInstallPath%Bin\Microsoft.Exchange.Store.Service.exe
Microsoft.Exchange.Store.Worker.exe
%ExchangeInstallPath%Bin\Microsoft.Exchange.Store.Worker.exe
TranscodingService.exe
%ExchangeInstallPath%ClientAccess\Owa\Bin\DocumentViewing\TranscodingService.exe
UmService.exe
%ExchangeInstallPath%Bin\UmService.exe
UmWorkerProcess.exe
%ExchangeInstallPath%Bin\UmWorkerProcess.exe
Microsoft.Exchange.UM.CallRouter.exe
%ExchangeInstallPath%FrontEnd\CallRouter\Microsoft.Exchange.UM.CallRouter.exe
%ExchangeInstallPath%FIP-FS\Bin\fms.exe
%ExchangeInstallPath%Bin\Search\Ceres\HostController\hostcontrollerservice.exe
MSExchangeDagMgmt.exe
%ExchangeInstallPath%Bin\MSExchangeDagMgmt.exe
MSExchangeDelivery.exe
%ExchangeInstallPath%Bin\MSExchangeDelivery.exe
MSExchangeFrontendTransport.exe
%ExchangeInstallPath%Bin\MSExchangeFrontendTransport.exe
MSExchangeHMHost.exe
%ExchangeInstallPath%Bin\MSExchangeHMHost.exe
MSExchangeHMWorker.exe
%ExchangeInstallPath%Bin\MSExchangeHMWorker.exe
ScanEngineTest.exe
%ExchangeInstallPath%FIP-FS\Bin\ScanEngineTest.exe
ScanningProcess.exe
%ExchangeInstallPath%FIP-FS\Bin\ScanningProcess.exe
UpdateService.exe
%ExchangeInstallPath%FIP-FS\Bin\UpdateService.exe
MSExchangeCompliance.exe
%ExchangeInstallPath%Bin\MSExchangeCompliance.exe
wsbexchange.exe
%ExchangeInstallPath%Bin\wsbexchange.exe
|
| Exchange Server 2000 & 2003 Folders |
C:\Program Files\Exchsrvr\Mtadata
C:\Program Files\Exchsrvr\Mtadata\*.mta
C:\Program Files\Exchsrvr\*.log
C:\Program Files\Exchsrvr\Mailroot
C:\Program Files\Exchsrvr\Srsdata
C:\Program Files\Exchsrvr\IMCData
C:\Program Files\Exchsrvr\MDBData
C:\Program Files\Exchsrvr\Address
C:\Program Files\Exchsrvr\Bin
C:\Program Files\Exchsrvr\Exchweb
C:\Program Files\Exchsrvr\Res
C:\Program Files\Exchsrvr\Schema
C:\Program Files\Exchsrvr\Conndata
|
| Exchange Server 2007 Folders |
%ProgramFiles%\Microsoft\Exchange Server\Mailbox
%ProgramFiles%\Microsoft\Exchange Server\Mailbox\MDBTEMP
%ProgramFiles%\Microsoft\Exchange Server\TransportRoles
%ProgramFiles%\Microsoft\Exchange Server\TransportRoles\Logs
%ProgramFiles%\Microsoft\Exchange Server\TransportRoles\Pickup
%ProgramFiles%\Microsoft\Exchange Server\TransportRoles\Replay
%ProgramFiles%\Microsoft\Exchange Server\TransportRoles\Data\Queue
%ProgramFiles%\Microsoft\Exchange Server\TransportRoles\SenderReputation
%ProgramFiles%\Microsoft\Exchange Server\TransportRoles\IpFilter
%ProgramFiles%\Microsoft\Exchange Server\Logging
%ProgramFiles%\Microsoft\Exchange Server\ExchangeOAB
%ProgramFiles%\Microsoft\Exchange Server\Working\OleConverter
%ProgramFiles%\Microsoft\Exchange Server\TransportRoles\Data\Adam
%ProgramFiles%\Microsoft\Exchange Server\ClientAccess
%ProgramFiles%\Microsoft\Exchange Server\UnifiedMessaging\grammars
%ProgramFiles%\Microsoft\Exchange Server\UnifiedMessaging\Prompts
%ProgramFiles%\Microsoft\Exchange Server\UnifiedMessaging\voicemail
%ProgramFiles%\Microsoft\Exchange Server\UnifiedMessaging\badvoicemail
|
| Exchange Server 2010-2016 Folders |
%ExchangeInstallPath%Mailbox
%ExchangeInstallPath%Mailbox\MDBTEMP
%ExchangeInstallPath%GroupMetrics
%ExchangeInstallPath%TransportRoles\Logs
%ExchangeInstallPath%TransportRoles\Logs\Mailbox
%ExchangeInstallPath%TransportRoles\Logs\FrontEnd
%ExchangeInstallPath%TransportRoles\Pickup
%ExchangeInstallPath%TransportRoles\Replay
%ExchangeInstallPath%TransportRoles\Data\Queue
%ExchangeInstallPath%TransportRoles\Data\SenderReputation
%ExchangeInstallPath%TransportRoles\Data\IpFilter
%ExchangeInstallPath%TransportRoles\Data\Temp
%ExchangeInstallPath%TransportRoles\Data\Adam
%ExchangeInstallPath%ClientAccess
%ExchangeInstallPath%ClientAccess\OAB
%ExchangeInstallPath%ExchangeOAB
%ExchangeInstallPath%Working\OleConvertor
%ExchangeInstallPath%Logging
%ExchangeInstallPath%Logging\POP3
%ExchangeInstallPath%Logging\IMAP4
%ExchangeInstallPath%UnifiedMessaging\grammars
%ExchangeInstallPath%UnifiedMessaging\Prompts
%ExchangeInstallPath%UnifiedMessaging\voicemail
%ExchangeInstallPath%UnifiedMessaging\temp
%ExchangeInstallPath%FIP-FS
%SystemRoot%\Temp\ExchangeSetup
%SystemRoot%\Temp\OICE_*
|
Forefront Protection for Exchange Server
| Forefront Protection for Exchange Server Folders |
%ProgramFiles(x86)%\Microsoft Forefront Protection for Exchange Server
%ProgramFiles(x86)%\Microsoft Forefront Protection for Exchange Server\Data\Archive
%ProgramFiles(x86)%\Microsoft Forefront Protection for Exchange Server\Data\Quarantine
%ProgramFiles(x86)%\Microsoft Forefront Protection for Exchange Server\Data\Engines\x86
%ProgramFiles(x86)%\Microsoft Forefront Protection for Exchange Server\Data\Engines\amd64
%ProgramFiles(x86)%\Microsoft Forefront Protection for Exchange Server\Data
|
| Forefront Protection for Exchange Server Processes |
Adonavsvc.exe
FscController.exe
FscDiag.exe
FscExec.exe
FscImc.exe
FscManualScanner.exe
FscMonitor.exe
FscRealtimeScanner.exe
FscStarter.exe
FscStatsServ.exe
FscTransportScanner.exe
FscUtility.exe
FsEmailPickup.exe
FssaClient.exe
GetEngineFiles.exe
PerfmonitorSetup.exe
ScanEngineTest.exe
SemSetup.exe
FSCConfigurationServer.exe
FSCEventing.exe
FSCScheduledScanner.exe
MultiEngineScanner.exe
Kavehost.exe
FSCVSSWriter.exe
|
| Forefront Protection for Exchange Server File Name Extensions |
.avc
.cab
.cfg
.config
.da1
.dat
.def
.dt
.fdb
.fdm
.ide
.key
.klb
.kli
.lst
.mdb
.ppl
.set
.v3d
.vdb
.vdm
|
Источники информации:
Серверы с Skype for Business Server 2015
| Skype for Business Server Processes |
ABServer.exe
AcpMcuSvc.exe
ASMCUSvc.exe
AVMCUSvc.exe
ChannelService.exe
ClsAgent.exe
ComplianceService.exe
DataMCUSvc.exe
DataProxy.exe
FileTransferAgent.exe
HealthAgent.exe
IMMCUSvc.exe
LysSvc.exe
MasterReplicatorAgent.exe
MediaRelaySvc.exe
MediationServerSvc.exe
MRASSvc.exe
OcsAppServerHost.exe
ReplicaReplicatorAgent.exe
ReplicationApp.exe
RtcHost.exe
RTCSrv.exe
XmppProxy.exe
XmppTGW.exe
Fabric.exe
FabricDCA.exe
FabricHost.exe
|
| Skype for Business Server Folders |
%SystemRoot%\System32\LogFiles
%SystemRoot%\SysWow64\LogFiles
%SystemRoot%\Microsoft.NET\assembly\GAC_MSIL
%ProgramFiles%\Skype for Business Server 2015
%ProgramFiles%\Common Files\Skype for Business Server 2015\Watcher Node
%ProgramFiles%\Common Files\Skype for Business Server 2015
%ProgramFiles%\Common Files\Skype for Business Online
%SystemDrive%\RtcReplicaRoot
|
Источники информации:
Серверы с SharePoint Server 2003 - 2013
| SharePoint Server Common Folders |
%ProgramFiles%\Common Files\Microsoft Shared\Web Server Extensions
%SystemDrive%\inetpub\wwwroot\wss\VirtualDirectories
%SystemDrive%\inetpub\temp\IIS Temporary Compressed Files
%ProgramData%\Microsoft\SharePoint
%ProgramData%\Microsoft\SharePoint\Config
%SystemDrive%\Documents and Settings\All Users\Application Data\Microsoft\SharePoint\Config
%SystemRoot%\Microsoft.NET\Framework64\v2.0.50727\Temporary ASP.NET Files
%SystemRoot%\Microsoft.NET\Framework64\v2.0.50727\Config
%SystemRoot%\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files
%SystemRoot%\Microsoft.NET\Framework64\v4.0.30319\Config
%SystemRoot%\System32\LogFiles
%SystemRoot%\Syswow64\LogFiles
%SystemRoot%\Temp\WebTempDir
%SystemRoot%\Temp\FrontPageTempDir
%SystemDrive%\Users\Default\AppData\Local\Temp
%SystemDrive%\Documents and Settings\Default User\Local Settings\Temp
%SystemDrive%\Users\<ServiceAccount>\Local
%SystemDrive%\Users\<ServiceAccount>\Local\Temp
%SystemDrive%\Documents and Settings\<ServiceAccount>\Local Settings\Application Data
%SystemDrive%\Users\<ServiceAccount>\AppData\Local\Temp
%SystemDrive%\Users\<ServiceAccount>\AppData\Local\Temp\WebTempDir
%SystemDrive%\Users\<account that the search service is running as>\AppData\Local\Temp
%SystemDrive%\Documents and Settings\<account that the search service is running as>\Local Settings\Temp
|
| SharePoint Server 2001 - 2003 Folders |
%ProgramFiles%\SharePoint Portal Server
%ProgramFiles%\Common Files\Microsoft Shared\Web Storage System
|
| Windows SharePoint Services 3.0 & SharePoint Server 2007 Folders |
%ProgramFiles%\Microsoft Office Servers\12.0\Data
%ProgramFiles%\Microsoft Office Servers\12.0\Logs
%ProgramFiles%\Microsoft Office Servers\12.0\Bin
%ProgramFiles%\Common Files\Microsoft Shared\Web Server Extensions\12\Logs
%ProgramFiles%\Common Files\Microsoft Shared\Web Server Extensions\12\Data\Applications
|
| SharePoint Server 2010 & SharePoint Foundation 2010 Folders |
%ProgramFiles%\Microsoft Office Servers\14.0\Data
%ProgramFiles%\Microsoft Office Servers\14.0\Logs
%ProgramFiles%\Microsoft Office Servers\14.0\Bin
%ProgramFiles%\Microsoft Office Servers\14.0\Synchronization Service
%ProgramFiles%\Common Files\Microsoft Shared\Web Server Extensions\14\Logs
%ProgramFiles%\Common Files\Microsoft Shared\Web Server Extensions\14\Data\Applications
|
| SharePoint Foundation 2013 & SharePoint Server 2013 Folders |
%ProgramFiles%\Microsoft Office Servers\15.0\Data
%ProgramFiles%\Microsoft Office Servers\15.0\Logs
%ProgramFiles%\Microsoft Office Servers\15.0\Bin
%ProgramFiles%\Microsoft Office Servers\15.0\Synchronization Service
%ProgramFiles%\Common Files\Microsoft Shared\Web Server Extensions\15\Logs
%ProgramFiles%\Common Files\Microsoft Shared\Web Server Extensions\15\Data\Applications
|
Источники информации:
Серверы с Microsoft ISA Server / Forefront TMG Medium Business Edition
| ISA Server 2000/2004/ 2006, Forefront TMG MBE Folders |
%ProgramFiles%\Microsoft ISA Server
%ProgramFiles%\Microsoft ISA Server\ISALogs
%ProgramFiles%\Microsoft SQL Server
%ProgramFiles(x86)%\Microsoft ISA Server
%ProgramFiles(x86)%\Microsoft SQL Server
%SystemRoot%\Temp\ScanStorage
%ProgramFiles(x86)%\Microsoft ISA Server\Logs
D:\urlcache
%SystemDrive%\InetPub
|
| ISA Server 2000/2004/ 2006, Forefront TMG MBE Processes |
dsamain.exe
%WinDir%\System32\dsamain.exe
dailysum.exe
%ProgramFiles%\Microsoft ISA Server\dailysum.exe
%ProgramFiles(x86)%\Microsoft ISA Server\dailysum.exe
repgen.exe
%ProgramFiles%\Microsoft ISA Server\repgen.exe
isarepgen.exe
%ProgramFiles%\Microsoft ISA Server\isarepgen.exe
%ProgramFiles(x86)%\Microsoft ISA Server\isarepgen.exe
isadlviewer.exe
%ProgramFiles%\Microsoft ISA Server\isadlviewer.exe
%ProgramFiles(x86)%\Microsoft ISA Server\isadlviewer.exe
wspsrv.exe
%ProgramFiles%\Microsoft ISA Server\wspsrv.exe
%ProgramFiles(x86)%\Microsoft ISA Server\wspsrv.exe
mspadmin.exe
%ProgramFiles%\Microsoft ISA Server\mspadmin.exe
%ProgramFiles(x86)%\Microsoft ISA Server\mspadmin.exe
isastg.exe
%ProgramFiles%\Microsoft ISA Server\isastg.exe
%ProgramFiles(x86)%\Microsoft ISA Server\isastg.exe
w3prefch.exe
%ProgramFiles%\Microsoft ISA Server\w3prefch.exe
%ProgramFiles(x86)%\Microsoft ISA Server\w3prefch.exe
sqlsvr.exe
%ProgramFiles%\Microsoft SQL Server\MSSQL$MSFW\sqlservr.exe
%ProgramFiles(x86)%\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
%ProgramFiles(x86)%\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe
sqlmangr.exe
%ProgramFiles%\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
sqlwriter.exe
%ProgramFiles(x86)%\Microsoft SQL Server\90\Shared\sqlwriter.exe
%WinDir%\System32\inetsrv\inetinfo.exe
%WinDir%\System32\inetsrv\w3wp.exe
|
Источники информации:
Серверы с Microsoft Forefront TMG 2010 / UAG 2010
| Forefront TMG/UAG Folders |
%ProgramFiles%\Microsoft Forefront Threat Management Gateway
%ProgramFiles%\Microsoft Forefront Threat Management Gateway\Logs
%ProgramFiles%\Microsoft Forefront Unified Access Gateway
%ProgramFiles%\Microsoft SQL Server\MSSQL10.ISARS
%ProgramFiles%\Microsoft SQL Server\MSSQL10.MSFW
%SystemRoot%\Temp\ScanStorage
D:\urlcache (каталог файлов веб-кеша TMG может располагаться в другом месте)
|
| Forefront TMG/UAG Processes |
dailysum.exe
%ProgramFiles%\Microsoft Forefront Threat Management Gateway\dailysum.exe
isarepgen.exe
%ProgramFiles%\Microsoft Forefront Threat Management Gateway\isarepgen.exe
isadlviewer.exe
%ProgramFiles%\Microsoft Forefront Threat Management Gateway\isadlviewer.exe
IsaManagedCtrl.exe
%ProgramFiles%\Microsoft Forefront Threat Management Gateway\IsaManagedCtrl.exe
isastg.exe
%ProgramFiles%\Microsoft Forefront Threat Management Gateway\isastg.exe
mspadmin.exe
%ProgramFiles%\Microsoft Forefront Threat Management Gateway\mspadmin.exe
wspsrv.exe
%ProgramFiles%\Microsoft Forefront Threat Management Gateway\wspsrv.exe
w3prefch.exe
%ProgramFiles%\Microsoft Forefront Threat Management Gateway\w3prefch.exe
DnsAlgSrv.exe
%ProgramFiles%\Microsoft Forefront Unified Access Gateway\DnsAlgSrv.exe
MonitorMgrCom.exe
%ProgramFiles%\Microsoft Forefront Unified Access Gateway\MonitorMgrCom.exe
SessionMgrCom.exe
%ProgramFiles%\Microsoft Forefront Unified Access Gateway\SessionMgrCom.exe
ShareAccess.exe
%ProgramFiles%\Microsoft Forefront Unified Access Gateway\ShareAccess.exe
uagqessvc.exe
%ProgramFiles%\Microsoft Forefront Unified Access Gateway\uagqessvc.exe
uagrdpsvc.exe
%ProgramFiles%\Microsoft Forefront Unified Access Gateway\uagrdpsvc.exe
UserMgrCom.exe
%ProgramFiles%\Microsoft Forefront Unified Access Gateway\UserMgrCom.exe
WatchDogSrv.exe
%ProgramFiles%\Microsoft Forefront Unified Access Gateway\WatchDogSrv.exe
whlerrsrv.exe
%ProgramFiles%\Microsoft Forefront Unified Access Gateway\whlerrsrv.exe
whlios.exe
%ProgramFiles%\Microsoft Forefront Unified Access Gateway\whlios.exe
sqlservr.exe
%ProgramFiles%\Microsoft SQL Server\MSSQL10.ISARS\MSSQL\Binn\sqlservr.exe
%ProgramFiles%\Microsoft SQL Server\MSSQL10.MSFW\MSSQL\Binn\sqlservr.exe
ReportingServicesService.exe
%ProgramFiles%\Microsoft SQL Server\MSSQL10.ISARS\MSSQL\Binn\ReportingServicesService.exe
dsamain.exe
%WinDir%\System32\dsamain.exe
|
| Other executable processes (from default FEP Rule Template from SCCM 2012) |
IsaApplianceInit.exe
IsaMgmt.exe
MsFpcSqmAgent.exe
NicsRestorer.exe
NLBClear.exe
UpdateAgent.exe
VpnHelpr.exe
tmgpolicysuite.exe
tmgbpacmd.exe
tmgbpa.exe
bpa2visio.exe
tmgbpapack.exe
tmgdatapackager.exe
|
|
TMG cache files
|
.cdat
|
Источники информации:
Серверы баз данных Microsoft SQL Server 2005 – 2016
| SQL Server Common Processes |
SQLServr.exe
ReportingServicesService.exe
MSMDSrv.exe
|
| SQL Server Common File Name Extensions |
.mdf
.ldf
.ndf
.bak
.trn
.trc
.sqlaudit
.sql
|
| SQL Server 2005 Processes |
%ProgramFiles%\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\SQLServr.exe
%ProgramFiles%\Microsoft SQL Server\MSSQL.2\OLAP\Bin\MSMDSrv.exe
%ProgramFiles%\Microsoft SQL Server\MSSQL.3\Reporting Services\ReportServer\Bin\ReportingServicesService.exe
|
| SQL Server 2005 Folders |
%ProgramFiles%\Microsoft SQL Server\MSSQL.1\MSSQL\Data
%ProgramFiles%\Microsoft SQL Server\MSSQL.1\MSSQL\FTData
%ProgramFiles%\Microsoft SQL Server\MSSQL.2\OLAP\Log
%ProgramFiles%\Microsoft SQL Server\MSSQL.2\OLAP\Backup
%ProgramFiles%\Microsoft SQL Server\MSSQL.2\OLAP\Data
|
| SQL Server 2008 Processes |
%ProgramFiles%\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\SQLServr.exe
%ProgramFiles%\Microsoft SQL Server\MSAS10.MSSQLSERVER\OLAP\Bin\MSMDSrv.exe
%ProgramFiles%\Microsoft SQL Server\MSRS10.MSSQLSERVER\Reporting Services\ReportServer\Bin\ReportingServicesService.exe
|
| SQL Server 2008 Folders |
%ProgramFiles%\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Data
%ProgramFiles%\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\FTData
%ProgramFiles%\Microsoft SQL Server\MSAS10.MSSQLSERVER\OLAP\Log
%ProgramFiles%\Microsoft SQL Server\MSAS10.MSSQLSERVER\OLAP\Backup
%ProgramFiles%\Microsoft SQL Server\MSAS10.MSSQLSERVER\OLAP\Data
|
| SQL Server 2008 R2 Processes |
%ProgramFiles%\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\SQLServr.exe
%ProgramFiles%\Microsoft SQL Server\MSAS10_50.MSSQLSERVER\OLAP\Bin\MSMDSrv.exe
%ProgramFiles%\Microsoft SQL Server\MSRS10_50.MSSQLSERVER\Reporting Services\ReportServer\Bin\ReportingServicesService.exe
|
| SQL Server 2008 R2 Folders |
%ProgramFiles%\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Data
%ProgramFiles%\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\FTData
%ProgramFiles%\Microsoft SQL Server\MSAS10_50.MSSQLSERVER\OLAP\Log
%ProgramFiles%\Microsoft SQL Server\MSAS10_50.MSSQLSERVER\OLAP\Backup
%ProgramFiles%\Microsoft SQL Server\MSAS10_50.MSSQLSERVER\OLAP\Data
|
| SQL Server 2012 Processes |
%ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Binn\SQLServr.exe
%ProgramFiles%\Microsoft SQL Server\MSAS11.MSSQLSERVER\OLAP\Bin\MSMDSrv.exe
%ProgramFiles%\Microsoft SQL Server\MSRS11.MSSQLSERVER\Reporting Services\ReportServer\Bin\ReportingServicesService.exe
|
| SQL Server 2012 Folders |
%ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Data
%ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\FTData
%ProgramFiles%\Microsoft SQL Server\MSAS11.MSSQLSERVER\OLAP\Log
%ProgramFiles%\Microsoft SQL Server\MSAS11.MSSQLSERVER\OLAP\Backup
%ProgramFiles%\Microsoft SQL Server\MSAS11.MSSQLSERVER\OLAP\Data
|
| SQL Server 2014 Processes |
%ProgramFiles%\Microsoft SQL Server\MSSQL12.MSSQLSERVER\MSSQL\Binn\SQLServr.exe
%ProgramFiles%\Microsoft SQL Server\MSAS12.MSSQLSERVER\OLAP\Bin\MSMDSrv.exe
%ProgramFiles%\Microsoft SQL Server\MSRS12.MSSQLSERVER\Reporting Services\ReportServer\Bin\ReportingServicesService.exe
|
| SQL Server 2014 Folders |
%ProgramFiles%\Microsoft SQL Server\MSSQL12.MSSQLSERVER\MSSQL\Data
%ProgramFiles%\Microsoft SQL Server\MSSQL12.MSSQLSERVER\MSSQL\FTData
%ProgramFiles%\Microsoft SQL Server\MSAS12.MSSQLSERVER\OLAP\Log
%ProgramFiles%\Microsoft SQL Server\MSAS12.MSSQLSERVER\OLAP\Backup
%ProgramFiles%\Microsoft SQL Server\MSAS12.MSSQLSERVER\OLAP\Data
|
| SQL Server 2016 Processes |
%ProgramFiles%\Microsoft SQL Server\MSSQL13.MSSQLSERVER\MSSQL\Binn\SQLServr.exe
%ProgramFiles%\Microsoft SQL Server\MSAS13.MSSQLSERVER\OLAP\Bin\MSMDSrv.exe
%ProgramFiles%\Microsoft SQL Server\MSRS13.MSSQLSERVER\Reporting Services\ReportServer\Bin\ReportingServicesService.exe
|
| SQL Server 2016 Folders |
%ProgramFiles%\Microsoft SQL Server\MSSQL13.MSSQLSERVER\MSSQL\Data
%ProgramFiles%\Microsoft SQL Server\MSSQL13.MSSQLSERVER\MSSQL\FTData
%ProgramFiles%\Microsoft SQL Server\MSAS13.MSSQLSERVER\OLAP\Log
%ProgramFiles%\Microsoft SQL Server\MSAS13.MSSQLSERVER\OLAP\Backup
%ProgramFiles%\Microsoft SQL Server\MSAS13.MSSQLSERVER\OLAP\Data
|
Примечание: если используются именованные экземпляры SQL Server, то выделенное красным цветом имя экземпляра по-умолчанию MSSQLSERVER нужно заменять на своё имя экземпляра.
Источники информации:
Сторонние серверы баз данных под Windows
|
Oracle databases files
|
*.ora
*.ctl
|
|
Firebird, dBase, etc files
|
*.dbf
*.cdx
*.fdb
*.edb
*.ib
*.gdi
*.gdb
|
Компоненты Microsoft System Center
Microsoft System Center Virtual Machine Manager
|
SCVMM Common
Processes
|
vmmAgent.exe
vmmservice.exe
|
|
SCVMM Agent 2008 R2
|
%ProgramFiles%\Microsoft System Center Virtual Machine Manager 2008 R2\bin\vmmAgent.exe
|
|
SCVMM Agent 2012
|
%ProgramFiles%\Microsoft System Center 2012\Virtual Machine Manager\bin\vmmAgent.exe |
|
SCVMM Server 2012
|
%ProgramFiles%\Microsoft System Center 2012\Virtual Machine Manager\bin\vmmservice.exe |
|
SCVMM Agent 2012 R2
|
%ProgramFiles%\Microsoft System Center 2012 R2\Virtual Machine Manager\bin\vmmAgent.exe |
|
SCVMM Server 2012 R2
|
%ProgramFiles%\Microsoft System Center 2012 R2\Virtual Machine Manager\bin\vmmservice.exe |
Microsoft System Center Data Protection Manager
System Center DPM
Common Processes |
%WinDir%\Microsoft.net\Framework\v2.0.50727\csc.exe
%WinDir%\Microsoft.net\Framework\v4.0.30319\csc.exe
dpmra.exe
%ProgramFiles%\Microsoft Data Protection Manager\DPM\bin\dpmra.exe
|
|
System Center 2007-2010
DPM Server Files
|
%ProgramFiles%\Microsoft DPM\DPM\XSD
%ProgramFiles%\Microsoft DPM\DPM\Temp\MTA
%ProgramFiles%\Microsoft DPM\DPM\Volumes
%ProgramFiles%\Microsoft DPM\DPM\bin\dpmra.exe
|
|
System Center 2012
DPM Server Files
|
%ProgramFiles%\Microsoft System Center 2012\DPM\DPM\XSD
%ProgramFiles%\Microsoft System Center 2012\DPM\DPM\Temp\MTA
%ProgramFiles%\Microsoft System Center 2012\DPM\DPM\Volumes
%ProgramFiles%\Microsoft System Center 2012\DPM\DPM\bin\dpmra.exe
|
|
System Center 2012 R2
DPM Server Files
|
%ProgramFiles%\Microsoft System Center 2012 R2\DPM\DPM\XSD
%ProgramFiles%\Microsoft System Center 2012 R2\DPM\DPM\Temp\MTA
%ProgramFiles%\Microsoft System Center 2012 R2\DPM\DPM\Volumes
%ProgramFiles%\Microsoft System Center 2012 R2\DPM\DPM\bin\dpmra.exe
|
|
System Center 2016
DPM Server Files
|
%ProgramFiles%\Microsoft System Center 2016\DPM\DPM\XSD
%ProgramFiles%\Microsoft System Center 2016\DPM\DPM\Temp
%ProgramFiles%\Microsoft System Center 2016\DPM\DPM\Volumes
%ProgramFiles%\Microsoft System Center 2016\DPM\DPM\bin\dpmra.exe
Drive letter of Modern Backup Storage volume
%ProgramFiles%\Microsoft Azure Recovery Services Agent\
%ProgramFiles%\Microsoft Azure Recovery Services Agent\bin\cbengine.exe
|
Источники информации:
Microsoft System Center Operations Manager
|
SCOM 2005 – 2012 R2 Common File Name Extensions
|
.chk
.log
.edb
.WKF
.PQF
.PQF0
.PQF1
|
| SCOM Common Processes |
MomHost.exe
MonitoringHost.exe
HealthService.exe
CShost.exe
Microsoft.Mom.Sdk.ServiceHost.exe
|
| SCOM 2007 Processes |
%ProgramFiles%\System Center Operations Manager 2007\HealthService.exe
%ProgramFiles%\System Center Operations Manager 2007\Microsoft.Mom.ConfigServiceHost.exe
%ProgramFiles%\System Center Operations Manager 2007\MonitoringHost.exe
|
| SCOM 2007 Folders |
%ProgramFiles%\System Center Operations Manager 2007\Health Service State
|
| SCOM 2012 Processes (Server) |
%ProgramFiles%\System Center 2012\Operations Manager\Server\monitoringhost.exe
%ProgramFiles%\System Center Operations Manager 2012\Server\monitoringhost.exe
|
| SCOM 2012 Processes (Agent) |
%ProgramFiles%\System Center Operations Manager\Agent\monitoringhost.exe
|
| SCOM 2012 Folders (Server) |
%ProgramFiles%\System Center 2012\Operations Manager\Server\Health Service State
%ProgramFiles%\System Center Operations Manager 2012\Server\Health Service State
|
| SCOM 2012 Folders (Agent) |
%ProgramFiles%\System Center Operations Manager\Agent\Health Service State
|
| SCOM 2012 R2 Processes (Server) |
%ProgramFiles%\System Center 2012\Operations Manager\Server\monitoringhost.exe
|
| SCOM 2012 R2 Processes (Agent) |
%ProgramFiles%\System Center Operations Manager\Agent\monitoringhost.exe
|
| SCOM 2012 R2 Folders (Server) |
%ProgramFiles%\Microsoft System Center 2012 R2\Operations Manager\Server\Health Service State
%ProgramFiles%\System Center Operations Manager\Gateway\
\Health Service State
|
| SCOM 2012 R2 Folders (Agent) |
%ProgramFiles%\Microsoft Monitoring Agent\Agent\Health Service State
|
Источники информации:
Microsoft System Center Configuration Manager
| SCCM Server Common Files |
%ProgramFiles%\Microsoft Configuration Manager\Install.map
%ProgramFiles%\Microsoft Configuration Manager\inboxes
%ProgramFiles%\Microsoft Configuration Manager\Logs
%ProgramFiles%\SMS_CCM\ServiceData
%ProgramFiles(x86)%\Microsoft Configuration Manager\inboxes
%ProgramFiles(x86)%\Microsoft Configuration Manager\Logs
%ProgramFiles(x86)%\SMS_CCM\ServiceData
%SystemDrive%\SMSPKG
<DriveLetter>:\SMS_CCM\ServiceData
<DriveLetter>:\SMSSIG$
<DriveLetter>:\SMSPKGSIG
<DriveLetter>:\SMSPKG
<DriveLetter>:\SMSPKG<DriveLetter>$
<DriveLetter>:\SCCMContentLib
%SMS_LOG_PATH%
%SMS_ADMIN_UI_PATH%
|
| SCCM Agent Common Folders |
%SystemRoot%\System32\CCM\Cache
%SystemRoot%\ccmcache
%SystemRoot%\CCM\Logs
|
| SCCM Server Common Processes |
Smsexec.exe
Ccmexec.exe
CmRcService.exe
Sitecomp.exe
Smswriter.exe
Smssqlbkup.exe
|
Примечание: значение <DriveLetter> должно быть заменено на конкретные буквы дисков используемых установленным экземпляром SCCM, поэтому желательно, чтобы в организации существовала какая-то стандартизация в этом плане.
Источники информации:
Серверы виртуализации Microsoft Hyper-V
| Hyper-V Default Folders |
%PUBLIC%\Documents\Hyper-V\Virtual Hard Disks
%ProgramData%\Microsoft\Windows\Hyper-V
%ProgramData%\Microsoft\Windows\Hyper-V\Snapshots
%SystemDrive%\ClusterStorage
|
|
Hyper-V Processes
|
%SystemRoot%\system32\vmwp.exe
%SystemRoot%\system32\vmms.exe
%SystemRoot%\system32\vmicsvc.exe
|
|
Hyper-V File
File Name Extensions |
.xml
.vhdx
.vhd
.vfd
.avhd
.avhdx
.iso
.vsv
.bin
|
Источники информации:
Серверы с виртуализацией приложений Microsoft App-V
| Clients Windows XP or Windows Server 2003 |
%USERPROFILE%\Application Data\SoftGrid Client
%ALLUSERSPROFILE%\Application Data\Microsoft\Application Virtualization Client
%ALLUSERSPROFILE%\Documents\SoftGrid Client
|
| Clients Windows Vista, Windows Server 2008 or later |
%USERPROFILE%\AppData\Local\SoftGrid Client
%USERPROFILE%\AppData\Roaming\SoftGrid Client
%ProgramData%\Microsoft\Application Virtualization Client\SoftGrid Client
%ProgramData%\Microsoft\AppV\Client\
%USERPROFILE%\AppData\Local\Microsoft\AppV\Client\
|
Источники информации:
Дополнительные источники информации:
Поделиться ссылкой на эту запись:
Похожее
RSS - Записи
Обратная ссылка: Antivirus Exclusions « Share IT /
Reblogged this on Заметки IT Менеджера and commented:
Списки исключений для антивирусов, работающих на Windows Server
Обратная ссылка: Развертывание и конфигурирование клиентских компонент Forefront Client Security с помощью GPO | Блог IT-KB /
Обратная ссылка: Hyper-V Best Practies | Блог IT-KB /
Обратная ссылка: ИТ Вестник №08.2016 | Блог IT-KB /