Change Auditor Antivirus Exclusions (4313107)

Exclude Change Auditor components and monitored processes from antivirus software.

Quest recommends disabling Antivirus or excluding the following Change Auditor components and monitored processes from any antivirus software that uses technology similar to “Buffer Overrun Protection” or “On Access Scanner”.

Please exclude the following paths, as well as the subfolders and files contained therein:

C:\Program Files\Common Files\Quest\

C:\Program Files\Quest\ChangeAuditor\Agent\

Also, Lsass.EXE must be whitelisted due to agent injection for event collection.

• *Please note that in addition to the above exclusions, Quest recommends following Microsoft’s recommendations for Antivirus exclusions on Active Directory Domain Contollers: https://technet.microsoft.com/en-us/library/cc816917(v=ws.10).aspx

If the Antivirus program utilized requires direct file paths, below is a list of all Change Auditor agent processes that need to be excluded: