> For the complete documentation index, see [llms.txt](https://docs.easy2patch.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.easy2patch.com/planning/antivirus-exclusion-list-for-easy2patchv4.md). # Antivirus Exclusion List for Easy2PatchV4 Easy2Patch 4.0 Easy2Patch downloads third-party vendor installers, builds deployment packages and delivers them to endpoints through Microsoft Configuration Manager, WSUS or Intune. Antivirus and endpoint protection products sometimes interfere with these operations. This article documents the folders, processes and operations that Easy2Patch uses, so that your security team has the information needed to review them against your own policies. It is reference material for planning, not a configuration requirement. > **Please note** > > **Antivirus exclusions reduce the coverage of your security controls. Whether to configure any of the items listed here, and at what scope, is a decision for your organization, to be taken in line with your internal security policy and the guidance of your antivirus vendor. Easy2Patch operates without exclusions in many environments; exclusions are normally considered only where a security product is observed to interfere with a specific operation. Responsibility for evaluating, applying and reviewing any exclusion rests with the organization that configures it.** Unlike Easy2Patch v3, which ran on a single machine, v4 is a server product, so the relevant paths are spread across several systems. *** ### Systems involved | System | Role | | ----------------------- | --------------------------------------------------------------------------------- | | Easy2Patch web server | Downloads vendor installers, extracts the catalog, signs scripts, builds packages | | ConfigMgr content share | Stores the published application content | | WSUS server | Stores locally published updates | | SQL Server | Hosts the Easy2Patch database | | Managed endpoints | Run the Easy2Patch detection scripts and installation components | ### 1. Easy2Patch web server #### 1.1 Application folders These folders are read and written continuously during normal operation. Where an exclusion is considered, it is normally applied recursively. | Path | Contents | | ------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `%ProgramFiles%\Easy2Patch Web Edition` | Application root (default installation path) | | `%ProgramFiles%\Easy2Patch Web Edition\Logs` | Application logs: `E2PApi.log`, `E2PApplication.log`, `E2PIntuneApplication.log`, `E2PUpdate.log`, `E2PEFLog.log`, `E2PDefender.log`, `E2PNone.log` and rotated `*.lo_` files | | `%ProgramFiles%\Easy2Patch Web Edition\Resources` | `E2PDTTool.exe`, `E2PUI.exe` | | `%ProgramFiles%\Easy2Patch Web Edition\FTW` | Setup wizard and database scripts | | `%ProgramFiles%\Easy2Patch Web Edition\ConfigMgr` | ConfigMgr/WSUS agent sub-application | | `%ProgramFiles%\Easy2Patch Web Edition\wwwroot` | Management console (web assets) | #### 1.2 Download and staging folders The download root is configured in **Settings → General → Path**. By default it is the root of the first fixed drive on the server. Replace `` below with the drive letter configured in your installation. | Path | Contents | | ------------------------------------------------ | ------------------------------------------------------- | | `\Download` | Downloaded catalog archive | | `\Download\Extract` | Extracted catalog metadata | | `\Download\Deployment` | Deployment working folder | | `\Download\Deployment\Publish` | Published package content | | `\Download\Deployment\Publish\V2` | Update metadata (`*.sdp`) | | `\Download\Temporary` | Downloaded vendor installers, one subfolder per package | `\Download` covers all of the above. Every installer Easy2Patch publishes passes through `Download\Temporary`, where its digest is verified against the catalog. If a security product locks or quarantines a file during this stage, the digest check fails and the publish operation reports a download error rather than a virus detection. This is the most common reason for unexplained publish failures. #### 1.3 Temporary folders Easy2Patch also writes to the temporary folder of the IIS application pool identity. | Path | Contents | | ----------------------------- | ------------------------------------------------------ | | `%TEMP%\E2P-Extract` | Catalog extraction | | `%TEMP%\dtScriptTemplate.ps1` | Detection script, created and signed during publishing | | `%TEMP%\tempSignSicript.ps1` | Signing working file | | `%TEMP%\E2P-SelfSignedCert` | WSUS code-signing certificate generation | | `%TEMP%\` | Intune package (`.intunewin`) creation | `%TEMP%` resolves according to the application pool identity: | Application pool configuration | Temporary folder | | ---------------------------------------------------------------------------------------- | --------------------------------------------------- | | Application pool identity without a loaded user profile, `LocalSystem`, `NetworkService` | `%SystemRoot%\Temp` | | Application pool with **Load User Profile** enabled | `%SystemDrive%\Users\\AppData\Local\Temp` | | Dedicated domain service account | `%SystemDrive%\Users\\AppData\Local\Temp` | Determine which applies to your installation. Only the Easy2Patch subfolders listed above are involved; the temporary folder as a whole is not. #### 1.4 IIS and .NET folders These are standard IIS hosting locations, listed because the ConfigMgr agent sub-application compiles into them. | Path | | --------------------------------------------------------------------------- | | `%SystemDrive%\inetpub\temp` | | `%SystemDrive%\inetpub\logs` | | `%SystemRoot%\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files` | #### 1.5 Processes | Process | Path | | ---------------------- | ------------------------------------------------------------------------ | | IIS worker process | `%SystemRoot%\System32\inetsrv\w3wp.exe` | | .NET host | `%ProgramFiles%\dotnet\dotnet.exe` | | Easy2Patch host | `%ProgramFiles%\Easy2Patch Web Edition\Easy2Patch.ClientUIWebPortal.exe` | | Setup wizard | `%ProgramFiles%\Easy2Patch Web Edition\FTW\FTW.exe` | | Code-signing tool | `%ProgramFiles%\Easy2Patch Web Edition\signtool.exe` | | Script runner | `%ProgramFiles%\Easy2Patch Web Edition\Resources\E2PDTTool.exe` | | Notification component | `%ProgramFiles%\Easy2Patch Web Edition\Resources\E2PUI.exe` | `w3wp.exe` hosts all IIS applications on the server, not only Easy2Patch. If your antivirus product supports scoping process rules to a specific application pool, restricting them to the **Easy2Patch** and **ConfigMgr** application pools keeps the scope narrower. #### 1.6 Integrity verification Before each publish operation, Easy2Patch verifies the SHA-256 hash of `signtool.exe`, `E2PDTTool.exe` and `E2PUI.exe`, and verifies `E2PDTTool.exe` and `E2PUI.exe` again after they are copied to the content share. If a security product quarantines or modifies any of these files, the publish operation stops with a hash mismatch error rather than continuing with an altered file. *** ### 2. ConfigMgr content share Application content is written to the UNC path configured in **Settings → Application Deployment → Content Folder**, using the following structure: ``` \\\\\\\ E2PDTTool.exe E2PUI.exe appInfo.txt ``` This path is relevant on the file server that hosts the share. Microsoft's standard Configuration Manager antivirus guidance applies to the site server and distribution points independently of Easy2Patch. *** ### 3. WSUS server | Path | | ---------------------------------------------------------- | | `%ProgramFiles%\Update Services` | | The `WsusContent` folder on the volume where it is located | *** ### 4. SQL Server The instance hosting the Easy2Patch database is covered by Microsoft's standard SQL Server antivirus guidance (`*.mdf`, `*.ldf`, `*.ndf`, backup folders, `sqlservr.exe`). The Easy2Patch database stores catalog content and background job state and is written to continuously. *** ### 5. Managed endpoints Two Easy2Patch components run on managed endpoints: `E2PDTTool.exe`, which performs installation and uninstallation, and `E2PUI.exe`, which displays end-user notifications. In addition, the deployment platform writes the Easy2Patch detection and requirement scripts to its system temporary folder and executes them from there. #### 5.1 Folders | Path | Contents | | -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ | | `%SystemRoot%\ccmcache` | ConfigMgr content: vendor installer, `E2PDTTool.exe`, `E2PUI.exe`, `appInfo.txt`, `msi.log` | | `%SystemRoot%\CCM\SystemTemp` | Detection and requirement scripts executed in system context | | `%SystemRoot%\CCM\ScriptStore` | Cached deployment scripts | | `%ProgramData%\Microsoft\IntuneManagementExtension\Content\Incoming` | Intune package as delivered | | `%ProgramData%\Microsoft\IntuneManagementExtension\Content\Staging` | Intune package after extraction | | `%ProgramData%\Microsoft\IntuneManagementExtension\Policies\Scripts` | Intune detection and requirement scripts | | `%SystemRoot%\Temp\E2P` | `E2PDTTool.exe` log files, one per package, when running in system context | | `%TEMP%\E2P` | `E2PDTTool.exe` log files when running in user context | | `%ProgramData%\Easy2PatchLog` | Detection script log `E2PLogs.log` and its rotated copy `E2PLogs.lo_`, written in system context | | `%TEMP%\E2PLogs.log` | Detection script log when the script runs in user context | Only the `E2P` subfolder of `%SystemRoot%\Temp` is involved, not the folder as a whole. #### 5.2 Processes | Process | Path | | --------------------------- | ------------------------------------------------------------- | | Installation runner | `E2PDTTool.exe` | | End-user notification | `E2PUI.exe` | | Windows PowerShell (64-bit) | `%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe` | | Windows PowerShell (32-bit) | `%SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe` | Both PowerShell hosts are involved: the Easy2Patch detection script performs a separate 32-bit pass in order to read the `WOW6432Node` uninstall registry hive. Where your antivirus product allows it, rules can be scoped to scripts executed from the ConfigMgr or Intune script folders listed in section 5.1, which is narrower than addressing `powershell.exe` as a whole. `E2PDTTool.exe` starts `msiexec.exe` and `cmd.exe` during installation and uninstallation, and runs under the Configuration Manager client (`CcmExec.exe`). These are shared Windows and Configuration Manager components used by all software deployment on the machine, so addressing the content folders in section 5.1 is more precise than addressing those processes. #### 5.3 Behavioral detections Folder and process rules do not affect behavior-based detection. The following operations are part of normal Easy2Patch installation behavior and may be reported by endpoint detection and response products. If they are, they are typically handled with a behavioral allow rule or a file-hash indicator rather than a folder exclusion. | Operation | Purpose | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Writing a `Debugger` value under `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\.exe`, in both the 32-bit and 64-bit registry views | Prevents the user from restarting the application while it is being updated. The value points to `E2PUI.exe`, which displays an update-in-progress message, and is removed once installation completes. Corresponds to MITRE ATT\&CK technique T1546.012 | | Terminating running applications listed in the package's process conflict list | Releases file locks so the installation can proceed. T1562.001 | | Running the application's registered uninstall command through `cmd.exe` from the content folder | Standard uninstall path for EXE-based applications. T1059.003 | | Enumerating all subkeys of `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall` in both registry views | Detects the installed version of the target application. T1518 | Where registry rules are supported, scoping the Image File Execution Options entry to writes performed by `E2PDTTool.exe` is narrower than addressing the registry key itself. #### 5.4 Microsoft Defender attack surface reduction rules The following ASR rules can block third-party application deployment. Microsoft supports per-rule exclusions, which allow the ConfigMgr content share and the ConfigMgr cache to be addressed without turning the rule off. * Block executable files from running unless they meet a prevalence, age, or trusted list criterion * Use advanced protection against ransomware * Block process creations originating from PSExec and WMI commands *** ### 6. File types Within the folders listed in sections 1.2, 2 and 5.1, the following file types occur during normal operation: `.exe` · `.msi` · `.msp` · `.msu` · `.zip` · `.cab` · `.sdp` · `.intunewin` · `.ps1` · `.txt` · `.json` These are common file types found throughout Windows. Any rule based on them is far more precise when scoped to the folders above than when applied globally. *** ### 7. Network access Where a web filtering, TLS inspection or egress proxy layer is in place, the Easy2Patch server requires access to:
DestinationPurpose
https://license.arksoft.com.trLicensing and catalog download
https://graph.microsoft.comIntune application management and Entra ID
https://login.microsoftonline.comAuthentication
https://api.securitycenter.microsoft.comMicrosoft Defender for Endpoint vulnerability data
Configured timestamp server (default http://timestamp.digicert.com)Code signing
https://picblobstorage.blob.core.windows.net/*Installer downloads
Vendor download URLs are supplied by the catalog and change with each catalog release, so a fixed list is not possible. Outbound HTTPS access from the Easy2Patch server, or a proxy configured under **Settings → Proxy** with the allow list maintained at the proxy, are the two usual approaches. Internal ports used: SQL Server `1433`, WSUS `8530` / `8531`, LDAP `389` / `636`, SMTP `587`, and DCOM/WMI (`135` plus the dynamic RPC range) to the ConfigMgr SMS Provider. ### 8. Scope guidance Where an exclusion is applied, keeping it as narrow as possible limits its effect on your overall protection. The following are broader than anything described in this article: | Broad | Narrower alternative | | ------------------------------------------------------- | ------------------------------------------------------------ | | The entire system drive or the `%ProgramFiles%` tree | The specific folders in section 1.1 | | `%SystemRoot%\Temp` in full | `%SystemRoot%\Temp\E2P` and the subfolders in section 1.3 | | `*.exe` or `*.ps1` as global file type rules | The same file types scoped to the folders in section 6 | | `msiexec.exe`, `cmd.exe`, `rundll32.exe`, `CcmExec.exe` | The content folders in section 5.1 | | `powershell.exe` across the endpoint estate | Scripts executed from the ConfigMgr or Intune script folders | | The Image File Execution Options registry key | Writes performed by `E2PDTTool.exe` | Reviewing any applied exclusion periodically, and removing it once it is no longer needed, is good practice. *** ### 9. Troubleshooting | Symptom | Likely cause | | ---------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- | | Publish fails with a download error, but the URL is reachable | The installer is being scanned or quarantined in `Download\Temporary`. See section 1.2 | | Publish fails with a hash mismatch for `E2PDTTool.exe` or `E2PUI.exe` | The file has been modified or quarantined on the content share. See section 2 | | Publish fails during script signing | The temporary folder in use does not match the application pool identity. See section 1.3 | | Deployment reports success but the application is not installed | An ASR rule is blocking the installer. See section 5.4 | | The target application cannot be started after a failed deployment | The Image File Execution Options entry was not removed. See section 5.3 | | Deployments fail on protected endpoints with no antivirus detection recorded | Check the endpoint detection and response behavior log against section 5.3 | Endpoint deployment failures are recorded in `%SystemRoot%\CCM\Logs\AppEnforce.log` and `AppDiscovery.log`, and in the Easy2Patch logs under `%SystemRoot%\Temp\E2P` and `%ProgramData%\Easy2PatchLog`. *** ### 10. About the Easy2Patch components `E2PDTTool.exe`, `E2PUI.exe` and `signtool.exe` are digitally signed, and their hashes are verified by the application before every publish operation. The vendor installers Easy2Patch distributes are downloaded over HTTPS and verified against the digest published in the Easy2Patch catalog. If a security product reports a detection on an Easy2Patch component, please contact Easy2Patch support with the detection details so that the file can be verified and, where appropriate, submitted to the vendor for review.