The following list of exclusions and trusted apps are needed to ensure any Anti-Virus coexisting with the Kaseya Agent allow it to function appropriately:
Exclusions
- <agent working directory>
- C:\Program Files\Kaseya\
- C:\Program Files (x86)\Kaseya\
- C:\Program Files\Kaseya Remote Control\
- C:\Program Files (x86)\Kaseya Remote Control\
- C:\ProgramData\Kaseya\
- C:\Program Files\Kaseya Live Connect\
-
C:\PCBP (for KDCB)
The agent working directory, by default, is c:\kworking\ but may have been changed by your VSA administrator. Please review this before setting exclusions.
Additionally, having multiple Kaseya Agents on an endpoint will cause the agent to have multiple agent working directories (ie; c:\kworking1\). Ensure that all agent working directories have exclusions set.
Trusted Apps
- <agent install directory>\AgentMon.exe
- <agent install directory>\KaseyaRemoteControlHost.exe
- <agent install directory>\KaUsrTsk.exe
- <agent install directory>\DLLRunner32.exe
- <agent install directory>\DLLRunner64.exe
- <agent install directory>\curl.exe
- <agent install directory>\Kaseya.AgentEndpoint.exe
- <agent install directory>\KDLLHost.exe
- <agent install directory>\kGetELMg64.exe
- <agent install directory>\KPrtPng.exe
- <agent install directory>\Endpoint\KaseyaEndpoint.exe
- <agent install directory>\Endpoint\KaseyaRemoteControlHost.exe
- <agent install directory>\Endpoint\KaseyaCommandShellProxy.exe
- <agent install directory>\Endpoint\KaseyaTaskRunnerx64.exe
- <agent install directory>\Endpoint\KaseyaTaskRunnerx86.exe
- <agent install directory>\System\NetUserStateAudit.exe
Trusted Apps for Software Management (KSM)
- C:\ProgramData\Kaseya\Data\task\lumension\7za.exe
- C:\ProgramData\Kaseya\Data\task\lumension\analyze.exe
- C:\ProgramData\Kaseya\Data\task\lumension\cabarc.exe
- C:\ProgramData\Kaseya\Data\task\lumension\EnvPrep.exe
- C:\ProgramData\Kaseya\Data\task\lumension\LM.Detection_x64.exe
- C:\ProgramData\Kaseya\Data\task\lumension\OSPXHelper.exe
- C:\ProgramData\Kaseya\Data\task\lumension\qchain.exe
- C:\ProgramData\Kaseya\Data\task\lumension\remediate.exe
- C:\ProgramData\Kaseya\Data\task\smpm\7za.exe
- C:\ProgramData\Kaseya\Data\task\smpm\GetFile.exe
- C:\ProgramData\Kaseya\Data\task\smpm\SmClient.exe
- C:\ProgramData\Kaseya\Data\task\smpm_pmclient\PmClient.exe
Trusted Apps for Kaseya Cloud Backup (KDCB)
-
C:\PCBP\WBPS.exe
-
C:\PCBP\WBPR.exe
-
C:\PCBP\bpnetd.exe
The agent install directory is where the Kaseya agent installs. Typically it is installed on C:\Program Files\Kaseya\<SERVER_GUID> where <SERVER_GUID> is a unique identifier to your VSA. If 64-bit, the install directory will be C:\Program Files (x86)\Kaseya\<SERVER_GUID>.
Trusted Apps for FireEye (if uses with an A/V)
|
Files
|
Default File Paths
|
Windows Version
|
|
audits.dll, mindexer.sys, and
xagt.exe
|
%ProgramFiles%\FireEye\xagt\*.*
|
32-bit
|
|
%ProgramFiles(x86)%\FireEye\xagt\*.*
|
64-bit
|
|
NamespaceToEvents32.dll
|
%SystemRoot%\FireEye\*.*
|
64-bit
|
|
NamespaceToEvents.dll
|
%SystemRoot%\FireEye\*.*
|
All
|
|
FeKern.sys
|
%SystemRoot%\System32\drivers\FeKern.sys
|
All
|
|
Everything in the
ProgramData\FireEye\xagt
Directory
|
%ALLUSERSPROFILE%\Application
Data\FireEye\xagt\*.*
|
NT 5.x
|
|
%ProgramData%\FireEye\xagt\*.*
|
NT 6+
|
|
xagtnotif.exe
|
%SystemRoot%\FireEye\xagtnotif.exe
|
All
|
|
Any extensions in %ALLUSERSPROFILE%\Application
Data\FireEye\xagt\exts directories or subdirectories should be
whitelisted in your antivirus software.
|
All
|
|
AppMonitorDll32_xx.dll
JavaAgentDll32_xx.dll
|
%SystemRoot%\FireEye\AppMonitorDll32_xx.dll
%SystemRoot%\FireEye\JavaAgentDll32_xx.dll
(where xx is a series of incrementing numbers)
|
64-bit
|
|
AppUIMonitor_xx.exe
AppMonitorDll_xx.dll
JavaAgentDll_xx.dll
|
%SystemRoot%\FireEye\AppUIMonitor_xx.exe
%SystemRoot%\FireEye\AppMonitorDll_xx.dll
%SystemRoot%\FireEye\JavaAgentDll_xx.dll
(where xx is a series of incrementing numbers)
|
All
|
|
All = All supported versions of Windows
32-bit = 32-bit versions of Windows
64-bit = 64-bit versions of Windows
NT 5.x = Windows XP SP3 and Windows Server 2003 SP2+R2
NT 6+ = All other supported Windows versions
|