After looking for a definitive answer for this I have found nothing of real value.
What is an application exception?
From what I can see in the SEPM I can monitor an application and then after being found I can choose to "Ignore, Log Only, Quarantine, Terminate, Remove". Not sure why I would need an exception that Quarantines?
An example for this would be Netbackup. http://www.symantec.com/business/support/index?pag...
I want to exclude the application/process bpbkar32.exe - Netbackup Backup Engine. Seems easy enough.
I make a file exception and exclude the file from Auto-Protect and Scans.Even better I can exclude the whole Netbackup directory...since it is in the Symantec document and it takes care of all.
File exception: C:\Program Files\VERITAS\NetBackup\bin\bpbkar32.exe
Folder exception: C:\Program Files\VERITAS\NetBackup\bin
Now it won't be scanned or detected and it gets skipped but what about an Application Exception?
- Do I need to also "Add an application to monitor" and then "Add an application" for bpbkar32.exe?
- What will this buy me? The file is already not scanned.
- If I set it to ignore what does this mean?
- If I don't set it as an application to monitor does this mean it gets checked each time it runs? Does SEP auto skip it due to the file/folder exception?
- Does it exclude Tamper Protection if I set it to ignore?
It seems easy to exclude things and not know the actual outcome. My feeling is I need to make a file/folder exception for Auto-Protect only. Thus it will get scanned. What about an application exception?
All the documentation I have found so far only tells me how to make one. Not really what it does or what it is for. In addition since it is a hash file for each application I could end up with a different hash file for each version. This could be a lot of application exceptions if I need to exclude many apps per exclusion documentation. SCCM, Windows Server, AD, Exchange, Sharepoint, Citrix, Terminal Servers, etc.
ADC seems to do all this work already. I can put it in there and watch it. Why do I need it here?