577
edits
Changes
Updated white listing, removed 'allowed signatures' as I believe it's for Forefront not MSE
== White-listing ==
See http://www.microsoft.com/security_essentials/HelpTopic.aspx?mkt=en-tt&assetid=f1b60a57-20d6-466e-b817-9e998a7d8a8c. Soon after installation MSE can recognise potentially useful software as a threat. For example if you have UltraVNC installed it will flag up UltraVNC.exe and RealVNC.exe. There's a risk that a user, when prompted, will choose to remove or quarantine such files and remove the administrator's ability to connect. Administrative users can allow, quarantine or remove suspicious files where as Limited users can only remove or quarantine suspicious files. Administrators will want to white-list any such programs that should not be considered a threat, upon installation.
White-listing can be performed manually using: Show details → Recommendation → Select an action → Allow → Apply actions (note that Close means 'don't take any action at this point') → Close. This is saved system-wide.
White-listing is saved in the registry so can be automated in any of the usual ways, see the [[Adding_Registry_Settings | registry editing section]].
* Excluded processes."Exclude files that are accessed by processes such as programs ... For example, if you don't want Microsoft Security Essentials to scan files that are accessed by Windows Live Messenger, add Messenger.exe to the list of excluded processes.". Add .exe, .cmd, .bat, .pif, .scf or .scr files.<br>The registry key is <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\ThreatsExclusions\ThreatIDDefaultActionProcesses</code>This contains a list of signatures which are allowed and the action to perform. 00000006 relates to the action "Allow".
* Excluded paths.Exclude particular files and/or locations from the scan.<br>The registry key is <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\ProcessesPaths</code>This contains exclusion processes.
* Excluded file types.Exclude particular files types / extensions from the scan.<br>The registry key is <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\PathsExtensions</code>This contains exclusion paths.
For a list of recommended files and file types to exclude see [http://support.microsoft.com/kb/822158 Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows]. Continuing with the above example to allow UltraVNC, the a .reg registry file should would look like this:
<source lang="reg">
Windows Registry Editor Version 5.00
; Set an exclusion path for winvnc.exe
== References ==
* [http://social.answers.microsoft.com/Forums/en/msestart/thread/a944fa0a-db4c-43da-affb-ab21eb9a4d65Silent Install] * [http://social.answers.microsoft.com/Forums/en-US/msestart/thread/56426422-5c5d-4296-a055-421b554f5eeehow to uninstall MSE if need arises?]
== Updates ==