MAJ : 04/01/2017
Ajout d’une exclusion dans la section UPM
Ajout de l’exclusion : %ProgramFiles%\Citrix\User Profile Manager\Driver\UpmJit.sys
MAJ : 07/10/2015
Ajout de la section PVS servers
Récemment nous avons du mettre en place des exclusions antivirus (pour des clients SEP 11 ) destinées à des environnements XenApp (5,6.0 et 6.5), et comme à chaque fois on avait pas sous la main une trame générique regroupant les principales exclusions antivirus Microsoft et Citrix .
Afin de ne plus chercher, nous avons regroupé les principales exclusions dans ce billet.
W2K8 R2
EdgeSight Exclusions Agent
- %ALLUSERSPROFILE%\Application Data\Citrix\System Monitoring\Data
- %ProgramFiles%\Citrix\System Monitoring\Agent\Core\rscorsvc.exe
- %ProgramFiles%\ Citrix\System Monitoring\Agent\Core\Firebird\bin\fbserver.exe
XenApp 6.5 Exclusions
- %ProgramFiles(x86)%\Citrix\Group Policy\Client-Side Extension\CitrixCseEngine.exe
- %ProgramFiles(x86)%\Citrix\System32\wfshell.exe
- %ProgramFiles(x86)%\Citrix\System32\ctxxmlss.exe
- %ProgramFiles(x86)%\Citrix\System32\CtxSvcHost.exe
- %ProgramFiles(x86)%\Citrix\System32\mfcom.exe
- %ProgramFiles(x86)%\Citrix\System32\Citrix\Ima\ImaSrv.exe
- %ProgramFiles(x86)%\Citrix\System32\Citrix\Ima\IMAAdvanceSrv.exe
- %ProgramFiles(x86)%\Citrix\HealthMon\HCAService.exe
- %ProgramFiles(x86)%\Citrix\Streaming Client\RadeSvc.exe
- %ProgramFiles(x86)%\Citrix\Streaming Client\RadeHlprSvc.exe
- %ProgramFiles(x86)%\Citrix\Independent Management Architecture\RadeOffline.mdb
- %ProgramFiles(x86)%\Citrix\Independent Management Architecture\imalhc.mdb
Windows Exclusions
- %windir%\SoftwareDistribution\Datastore\Datastore.edb
- %windir%\SoftwareDistribution\Datastore\Logs\*.log
- %windir%\SoftwareDistribution\Datastore\Logs\*.jrs
- %windir%\SoftwareDistribution\Datastore\Logs\Edb.chk
- %windir%\SoftwareDistribution\Datastore\Logs\Tmp.edb
- %windir%\Security\Database\*.edb
- %windir%\Security\Database\*.sdb
- %windir%\Security\Database\*.log
- %windir%\Security\Database\*.chk
- %windir%\Security\Database\*.jrs
- %allusersprofile%\NTUser.pol
- %windir%\System32\GroupPolicy\Machine\Registry.pol
- %windir%\system32\csrss.exe
- %windir%\system32\spoolsv.exe
- %windir%\system32\winlogon.exe
- %windir%\system32\userinit.exe
- %windir%\system32\smss.exe
- %windir%\System32\Spool
UPM
- %ProgramFiles%\Citrix\User Profile Manager\UserProfileManager.exe
- %ProgramFiles%\Citrix\User Profile Manager\Driver\UpmJit.sys
PVS (servers)
- %windir%\System32\drivers\CvhdBusP6.sys
- %windir%\System32\drivers\CfsDep2.sys
- %ProgramFiles%\Citrix\Provisioning Services\BNTFTP.EXE
- %ProgramData%\Citrix\Provisioning Services\Tftpboot\ARDBP32.BIN
- %ProgramFiles%\Citrix\Provisioning Services\StreamService.exe
- %ProgramFiles%\Citrix\Provisioning Services\StreamProcess.exe
- %ProgramFiles%\Citrix\Provisioning Services\soapserver.exe
- %ProgramFiles%\Citrix\Provisioning Services\PVSTSB.exe
- %ProgramFiles%\Citrix\Provisioning Services\BNAbsService.exe
- %ProgramFiles%\Citrix\Provisioning Services\Notifier.exe (à partir de PVS 6.0)
- %ProgramFiles%\Citrix\Provisioning Services\MgmtDaemon.exe (à partir de PVS 6.0)
- %ProgramFiles%\Citrix\Provisioning Services\Inventory.exe (à partir de PVS 6.0)
- …\Store (chemin du répertoire hébergeant les vDisk store)
PVS (poste cible)
- %ProgramFiles%\Citrix\Provisioning Services\drivers\CNicTeam.sys
- %ProgramFiles%\Citrix\Provisioning Services\BNDevice.exe
- %ProgramFiles%\Citrix\Provisioning Services\drivers\BNIStack6.sys
- %ProgramFiles%\Citrix\Provisioning Services\drivers\CVhdBusp6.sys
- …\.vdiskcache (emplacement du fichier de cache vdisk)
- %ProgramFiles%\Citrix\Provisioning Services\TargetOSOptimizer.exe
- %ProgramFiles%\Citrix\Provisioning Services\drivers\CFsDep2.sys
W2K3 (32 bits)
EdgeSight Exclusions Agent
- %ALLUSERSPROFILE%\Application Data\Citrix\System Monitoring\Data
- %ProgramFiles%\Citrix\System Monitoring\Agent\Core\rscorsvc.exe
- %ProgramFiles%\ Citrix\System Monitoring\Agent\Core\Firebird\bin\fbserver.exe
XenApp Exclusions
- %ProgramFiles%\Citrix\System32\wfshell.exe
- %ProgramFiles%\Citrix\System32\ctxxmlss.exe
- %ProgramFiles%\Citrix\System32\mfcom.exe
- %ProgramFiles%\Citrix\System32\Citrix\Ima\ImaSrv.exe
- %ProgramFiles%\Citrix\System32\Citrix\Ima\IMAAdvanceSrv.exe
- %ProgramFiles%\Citrix\HealthMon\HCAService.exe
- %ProgramFiles%\Citrix\Streaming Client\RadeSvc.exe
- %ProgramFiles%\Citrix\Independent Management Architecture\RadeOffline.mdb
- %ProgramFiles%\Citrix\Independent Management Architecture\imalhc.mdb
Windows Exclusions
- %windir%\SoftwareDistribution\Datastore\Datastore.edb
- %windir%\SoftwareDistribution\Datastore\Logs\*.log
- %windir%\SoftwareDistribution\Datastore\Logs\*.jrs
- %windir%\SoftwareDistribution\Datastore\Logs\Edb.chk
- %windir%\SoftwareDistribution\Datastore\Logs\Tmp.edb
- %windir%\Security\Database\*.edb
- %windir%\Security\Database\*.sdb
- %windir%\Security\Database\*.log
- %windir%\Security\Database\*.chk
- %windir%\Security\Database\*.jrs
- %allusersprofile%\NTUser.pol
- %Systemroot%\System32\GroupPolicy\Machine\Registry.pol
- %SystemRoot%\system32\csrss.exe
- %SystemRoot%\system32\spoolsv.exe
- %SystemRoot%\system32\winlogon.exe
- %SystemRoot%\system32\userinit.exe
- %SystemRoot%\system32\smss.exe
- %systemroot%\System32\Spool
UPM
- %ProgramFiles%\Citrix\User Profile Manager\UserProfileManager.exe
W2K3 64 bits
EdgeSight Exclusions Agent
- %ALLUSERSPROFILE%\Application Data\Citrix\System Monitoring\Data
- %ProgramFiles%\Citrix\System Monitoring\Agent\Core\rscorsvc.exe
- %ProgramFiles%\ Citrix\System Monitoring\Agent\Core\Firebird\bin\fbserver.exe
XenApp Exclusions
- %SystemRoot%\system32\csrss.exe
- %SystemRoot%\system32\spoolsv.exe
- %SystemRoot%\system32\winlogon.exe
- %SystemRoot%\system32\userinit.exe
- %SystemRoot%\system32\smss.exe
- %ProgramFiles(x86)%\Citrix\System32\wfshell.exe
- %ProgramFiles(x86)%\Citrix\System32\ctxxmlss.exe
- %ProgramFiles(x86)%\Citrix\System32\mfcom.exe
- %ProgramFiles(x86)%\Citrix\System32\Citrix\Ima\ImaSrv.exe
- %ProgramFiles(x86)%\Citrix\System32\Citrix\Ima\IMAAdvanceSrv.exe
- %ProgramFiles(x86)%\Citrix\HealthMon\HCAService.exe
- %ProgramFiles(x86)%\Citrix\Streaming Client\RadeSvc.exe
- %ProgramFiles(x86)%\Citrix\Independent Management Architecture\RadeOffline.mdb
- %ProgramFiles(x86)%\Citrix\Independent Management Architecture\imalhc.mdb
Windows Exclusions
- %SystemRoot%\SoftwareDistribution\Datastore\Datastore.edb
- %SystemRoot%\SoftwareDistribution\Datastore\Logs\*.log
- %SystemRoot%\SoftwareDistribution\Datastore\Logs\*.jrs
- %SystemRoot%\SoftwareDistribution\Datastore\Logs\Edb.chk
- %SystemRoot%\SoftwareDistribution\Datastore\Logs\Tmp.edb
- %SystemRoot%\Security\Database\*.edb
- %SystemRoot%\Security\Database\*.sdb
- %SystemRoot%\Security\Database\*.log
- %SystemRoot%\Security\Database\*.chk
- %SystemRoot%\Security\Database\*.jrs
- %allusersprofile%\NTUser.pol
- %Systemroot%\System32\GroupPolicy\Machine\Registry.pol
- %SystemRoot%\system32\csrss.exe
- %SystemRoot%\system32\spoolsv.exe
- %SystemRoot%\system32\winlogon.exe
- %SystemRoot%\system32\userinit.exe
- %SystemRoot%\system32\smss.exe
- %systemroot%\System32\Spool
UPM
- %ProgramFiles(x86)%\Citrix\User Profile Manager\UserProfileManager.exe
Web Interface
- %SystemRoot%\system32\LogFiles
- %systemroot%\system32\inetsrv
EdgeSight Server
- %SystemRoot%\system32\LogFiles
- %systemroot%\system32\inetsrv
- %ProgramFiles%\Citrix\System Monitoring\Server\EdgeSight\scripts\rssh
- %ProgramFiles%\Citrix\System Monitoring\Server\EdgeSight\Pages
Serveur de Licence Citrix
- %ProgramFiles(x86)%\Citrix\Licensing
- %systemroot%\system32\inetsrv
- %SystemRoot%\system32\LogFiles
Serveur de Licence RDS
- %SystemRoot%\System32\LServer\*.edb
- %SystemRoot%\System32\LServer\*.log
- %SystemRoot%\System32\LServer\*.tmp
- %SystemRoot%\System32\LServer\*.chk
Quelques liens sur les exclusions antivirus Microsoft et Citrix :
- https://community.mcafee.com/thread/4438?start=10&tstart=0
- http://support.citrix.com/article/CTX111062
- http://support.citrix.com/article/CTX114906
- http://support.citrix.com/article/CTX127030
- http://blogs.citrix.com/2013/09/22/citrix-consolidated-list-of-antivirus-exclusions/
- http://usa.kaspersky.com/sites/usa.kaspersky.com/files/Virus%20Scan%20Exclusions%20for%20Microsoft%20Products.pdf
- http://www.symantec.com/connect/sites/default/files/SEP_Citrix-Terminal_Servers_2.pdf
- http://esupport.trendmicro.com/solution/en-us/1059795.aspx
- http://social.technet.microsoft.com/wiki/contents/articles/953.microsoft-anti-virus-exclusion-list.aspx
