Change Auditor Antivirus Exclusions (234488)

Change Auditor Antivirus Exclusions

Exclude Change Auditor components and monitored processes from antivirus software.

Antivirus software can cause Change Auditor to function incorrectly or produce unexpected results.

Quest recommends disabling Antivirus or excluding the following Change Auditor components and monitored processes from any antivirus software that uses technology similar to “Buffer Overrun Protection” or “On Access Scanner”.

Please exclude the following paths, as well as the subfolders and files contained therein:

C:\Program Files\Common Files\Quest\

C:\Program Files\Quest\ChangeAuditor\Agent\

Also, Lsass.EXE must be whitelisted due to agent injection for event collection.

• *Please note that in addition to the above exclusions, Quest recommends following Microsoft’s recommendations for Antivirus exclusions on Active Directory Domain Contollers: https://technet.microsoft.com/en-us/library/cc816917(v=ws.10).aspx

 

If the Antivirus program utilized requires direct file paths, below is a list of all Change Auditor agent processes that need to be excluded: