Changes

See http://www.microsoft.com/security_essentials/HelpTopic.aspx?mkt=en-tt&assetid=f1b60a57-20d6-466e-b817-9e998a7d8a8c. Soon after installation MSE can recognise potentially useful software as a threat. For example if you have UltraVNC installed it will flag up UltraVNC.exe and RealVNC.exe. There's a risk that a user, when prompted, will choose to remove or quarantine such files and remove the administrator's ability to connect. Administrative users can allow, quarantine or remove suspicious files where as Limited users can only remove or quarantine suspicious files. Administrators will want to white-list any such programs that should not be considered a threat, upon installation.

The following Relevant white-listing registry keys and values settings are relevant:

* Excluded processes."Exclude files that are accessed by processes such as programs ... For example, if you don't want Microsoft Security Essentials to scan files that are accessed by Windows Live Messenger, add Messenger.exe to the list of excluded processes.". Add .exe, .cmd, .bat, .pif, .scf or .scr files.<br>The registry key is <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\ThreatsExclusions\ThreatIDDefaultActionProcesses</code>This contains a list of signatures which are allowed and the action to perform. 00000006 relates to the action "Allow".

* Excluded paths.Exclude particular files and/or locations from the scan.<br>The registry key is <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\ProcessesPaths</code>This contains exclusion processes.

* Excluded file types.Exclude particular files types / extensions from the scan.<br>The registry key is <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\PathsExtensions</code>This contains exclusion paths.

For a list of recommended files and file types to exclude see [http://support.microsoft.com/kb/822158 Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows]. Continuing with the above example to allow UltraVNC, the a .reg registry file should would look like this:

* [http://social.answers.microsoft.com/Forums/en/msestart/thread/a944fa0a-db4c-43da-affb-ab21eb9a4d65Silent Install] * [http://social.answers.microsoft.com/Forums/en-US/msestart/thread/56426422-5c5d-4296-a055-421b554f5eeehow to uninstall MSE if need arises?]